Re:Web Developer Security Checklist
by yetanotherjosh on Thursday May 18, 2017 @06:32PM
(#14371628)
> But it is not a good idea to use input sanitization as the only (or even main) method of injection attacks prevention
Can you define what you mean by "input sanitization"? Because in my mind, a prepared statement is doing just that. You say what part is your SQL, what part is your user input, and you let the DB adapter sanitize the input to build the final statement. You aren't writing sanitization code yourself, you're leaving it up to a library, but that's still what's happening. Or do you have a different term for what's going when a prepared statement routine converts user input into SQL-safe strings?
I never said:
1) That it was easy to do right: that's why we get paid.
2) That it was an excuse not to do other checks elsewhere: defence in depth is key.
Anyhow, I hope that we're really furiously agreeing.
Some basic sanity checks are useful, of course. But it is not a good idea to use input sanitization as the only (or even main) method of injection attacks prevention.