News for hackers. Stuff that matters.
Re:Don’t try to sanitize input – escape output by benhoyt on Thursday February 27, 2020 @02:20AM (#22431369)
There's value in doing both in certain cases (as long as you're definitely escaping output), but I'd be careful about the motivation. You say: "Sanitize your inputs so that it can be safely stored in your data store" -- but it's safe to store any string in your database as long as you escape/encode it correctly (i.e., use parameterized queries).

For example, what if someone posts a legitimate comment on reddit helping someone with SQL syntax for deleting tables and includes "DROP TABLE users" -- did you sanitize that away?

Re:Don’t try to sanitize input – escape output by jedberg on Thursday February 27, 2020 @03:44AM (#22431692)
> did you sanitize that away?

No, see my edit above. It was just parameterized.