News for hackers. Stuff that matters.

A comment on Don’t try to sanitize input – escape output. Parent comment

Re:Don’t try to sanitize input – escape output by jedberg on Thursday February 27, 2020 @04:59AM (#22432002)
It’s more a question of how you get them in there. For example if your data store is JSON based, you’ll need to escape some strings.
[ Parent | on HN ]
Re:Don’t try to sanitize input – escape output by TeMPOraL on Thursday February 27, 2020 @09:41AM (#22433620)
That sounds like a broken datastore API. In a properly designed API, you don't need to escape anything, because the API implementation ensures your data doesn't get read as code.
[ Parent | on HN ]