A report displays comments entered by users. What prevents stored script from executing in the browser when ordinary text is expected?

1. Naming the comment column SAFE_TEXT
2. Disabling all authorization schemes
3. Appropriate output escaping for the rendered context
4. Trusting the text because it was stored in the database