Don’t try to sanitize input – escape output

Re:Don’t try to sanitize input – escape output by zAy0LfpBZLC8mAC on Thursday February 27, 2020 @04:08AM (#22431795)

Now, you have ammended your comment to really say something very different (how is parameterized SQL 'basic' anything when it's actually the correct complete solution to the problem?).

But in any case, this still suggests a complete misunderstanding of the point of that blog post. As far as that blog post's point is concerned, the SQL database is an output of your program. And the whole point is that you need to escape/encode all outputs correctly, but you should not ever sanitize anything.

[ Parent | on HN ]

Re:Don’t try to sanitize input – escape output by jedberg on Thursday February 27, 2020 @04:16AM (#22431827)

Because as others have said, parameterized SQL is a long standing solution, so I consider it pretty basic, but I still consider it a form of sanitization that not everyone does, even though it's a long standing solution.

I think it is totally fair to interpret the article as saying that the database is a program output. And if you interpret it that way, what I said doesn't make sense.

That's just not how I interpreted it.

[ Parent | on HN ]