What common mistake do developers make with Raw output, why does the mistake cause problems, and what is the safer approach?

What common mistake do developers make with Raw output, why does the mistake cause problems, and what is the safer approach? One recurring problem with raw output is applying it without understanding the boundary it protects. Using unescaped output for user-provided text simply because it makes HTML rendering easier. In addition, Raw output bypasses normal HTML escaping and should only be used when the application deliberately trusts or sanitizes the content. Safer engineering approach: keep the responsibility in the correct layer, use the framework's supported API, validate and authorize inputs, avoid hidden side effects, and verify the behavior with tests.