Don’t try to sanitize input – escape output

Re:Don’t try to sanitize input – escape output by bloak on Thursday February 27, 2020 @04:46AM (#22431965)

> Sanitize your inputs so that it can be safely stored in your data store

What kind of data store can't hold all possible strings of characters? Except perhaps '\0'. I'll make an exception for '\0'.

(EDIT: There is of course the question of what you mean by a character. Sometimes it's an octet. Sometimes it's a Unicode code point.)

[ Parent | on HN ]

Re:Don’t try to sanitize input – escape output by jedberg on Thursday February 27, 2020 @04:59AM (#22432002)

It’s more a question of how you get them in there. For example if your data store is JSON based, you’ll need to escape some strings.

[ Parent | on HN ]

Re:Don’t try to sanitize input – escape output by TeMPOraL on Thursday February 27, 2020 @09:41AM (#22433620)

That sounds like a broken datastore API. In a properly designed API, you don't need to escape anything, because the API implementation ensures your data doesn't get read as code.

[ Parent | on HN ]