A secure application needs to carefully handle input and output of untrusted data. As the case may be, we say that values have to be escaped, filtered, validated or sanitized. There seems to be a sloppy and interchangeable usage of these terms although they are not equivalent.

I'm looking for a definitive overview about the differences and the correct usage in a security context.

An application needs to handle input and output of untrusted data carefully. As the case may be, values have to be escaped, filtered, validated or sanitized. There often seems to be a sloppy and interchangeable use of these terms although they are obviously not all equivalent.

I'm looking for a clarifying overview about the differences and the correct usage in a security context.