Sanitize is not fool proof (yet) .Sanitize2 seems to work as advertized.

>
>
>(1) By the rule: don't touch unevaluated material  *at all* the 
>sanitized version of this
>function would be
>
>f(cos,uniq):=cos(uniq)^2
>
>(2) By the rule: don't touch unevaluated material *inside the function 
>body* the
>sanitized version would be
>
>f(uniq1,uniq2):=cos(uniq2)^2
>
Unfortunately I now see that it may not be possible to detect 
unevaluated material syntactically. What about
f('x):=x$
g(y):=f(y)$
g(z);
      y
This case is still ok in a sense since sanitize(-) could look up the 
definition of f. But if f is defined
dynamically inside some other function it becomes problem.

In principle the solution to this problem would be that sanitize(g) adds 
code to g to detect evaluated/unevaluated arguments to operators *at 
runtime* (some suitable lisp function should be written for this). But 
perhaps this is going too far? And maybe it is not even possible?

 Michel