Let us say your web app is sanitizing bad input and displaying the user what the bad input was. Before XSS measure was put in place web app is spitting out malicious script as is. For example Bad address value :
<script>bad script goes here </script>
Now after careful sanitizing output could be something like this. Bad street address : sanitized input. If the input was let us say not script like !@#$ street then it would output Bad street address : !@#$
Do you think using word sanitized is too obvious for output string that is malicious. I figure regular users wont see this. But bad guys are the only ones will see sanitized. Or should the app not say anything at all if it sanitizes the input. Or should it replace some of the bad script tags with something other. What is the best known industry best practice here?