News for hackers. Stuff that matters.

A comment on Parse, Don’t Validate. Parent comment

Re:Parse, Don’t Validate by kortilla on Thursday November 07, 2019 @08:04PM (#21479143)
Not sure if you’ve worked with databases before, but sql injection sanitization belongs at the SQL layer, not the user input validation layer.

If you’re doing it at user input validation, you’re doing it wrong.

[ Parent | on HN ]
Re:Parse, Don’t Validate by jiggawatts on Thursday November 07, 2019 @10:42PM (#21479797)
This!

It's impossible to do SQL-safety validation at any other layer, because otherwise you're making the assertion that someone with the last name "O'Neil" or "Null" (Yes! A real name!) may as well give up and legally change it for the "safety" of programmers that are too lazy to do thing right.

[ Parent | on HN ]