Which statement best describes the method to prevent XSS when rendering user-generated content?

Which statement best describes the method to prevent XSS when rendering user-generated content?

• A. Render all user input without modification.
• B. Disable all HTML rendering globally.
• C. Use client-side sanitization only.
• D. Use output encoding/escaping, sanitize inputs, and avoid rendering raw user input unless sanitized.

Answer: (D)