News for hackers. Stuff that matters.

A comment on Parse, Don’t Validate. Parent comment

Re:Parse, Don’t Validate by kortilla on Thursday November 07, 2019 @08:02PM (#21479134)
“DELETE * from table” is a safe string though for something like file contents or perhaps a comment box on a hacker news site.

The term “safe string” is effectively meaningless because it entirely depends on how the internals are going to use it.

[ Parent | on HN ]
Re:Parse, Don’t Validate by youerbt on Friday November 08, 2019 @04:01AM (#21480830)
But of course nobody is talking about universally safe strings. It's just a name to explain the concept.

Point being, if my database API uses the different types than my random internet input types, compiler will force me to convert/parse those.

[ Parent | on HN ]