Why does text break a program when it is passed into a search-and-replace, a query, or a format string?

Some positions in code interpret what they are given instead of taking it literally.

Text you did not author must never be placed in one of those positions raw - pass it as a function or an escaped literal.

A replacement string, a query string and a format string are not text slots. They are small languages. Certain characters inside them are instructions, and the moment your data contains one, the data stops being data. Python's re.sub is the clearest case: the replacement argument is a template, where a backslash sequence means "do something" rather than "type this". Hand it a title containing an escape sequence and it tries to obey it and stops. The fix is not to sanitise the text, which is a guess about which characters matter. The fix is to pass a function that returns the string, so nothing is ever parsed. The same shape recurs everywhere: a full-text query where quotes and operators are syntax, a format string where braces are syntax, a shell argument where spaces and semicolons are syntax, an SQL statement where the whole thing is syntax. Every one of them has a form that takes data as data - a parameter, a callable, a quoted token, an argument list. Use it by default, not after the first crash. The danger is that these bugs are quiet. The raw form works perfectly for months, because ordinary text contains no special characters. It fails on the first name with a punctuation mark in it, and it fails at scale, all at once, in whatever was running that day. So the rule is not "escape carefully". It is: if a slot interprets syntax, never hand it text you did not write.

Page titles carried a middot written as an escape sequence. Passed as the replacement in a search-and-replace, it read as an instruction rather than a character, and all sixteen builds stopped. Passing a function instead of the raw string fixed the whole class at once. Seventy-two call sites across twenty scripts are still on the raw form - including thirteen in the prose checker and eight in the rule validator, both of which are gates. Neither has fired yet, because nothing has passed them a backslash.

More from the same record, pulled by shared topic — not written new for this page.

Some positions in code interpret what they are given instead of taking it literally. Text you did not author must never be placed in one of those positions raw - pass it as a function or an escaped literal.