Why should you rely on framework protections against XSS?

Because XSS payloads exploit dozens of obscure parsing quirks (case tricks, Unicode escapes, comment breakouts) that hand-rolled filters miss — framework escaping is battle-tested against all of them.

Modern frameworks have built-in XSS protections that handle edge cases you might miss.

Complex bypass example:

-->"/></sCript><deTailS open x=">" ontoggle=(co\u006efirm)`>

This payload:

• Breaks out of HTML comments (-->)
• Closes attributes and tags ("/>)
• Uses case variations (sCript)
• Uses unknown tags (deTailS)
• Uses event handlers (ontoggle)
• Uses Unicode escapes (\u006e = 'n')
• Uses template literals (backticks)

Lesson: Use framework escaping; don't build your own.