We have a REST API that returns user generated content from a database. Before inserting the data into the database the data is sanitized. But when returning the data we do not escape / decode the data, so in theory it would be possible to insert some user content that will execute an attack, once it is consumed from the client.
Right now the only client is an internal one, that displays the data in some HTML frontend.
Now my question is, should the API return json escaped JSON? Or should the client make sure to html escape the received content?
I am split here in my personal opinion, in general I would return data as is from any API and let take the client care of escaping (as there could be several different clients and the API should be agnostic to its content). On the other hand its an internal one and we know how we use it, so it could return escaped data.