Don’t try to sanitize input – escape output

Re:Don’t try to sanitize input – escape output by dropmann on Thursday February 27, 2020 @06:42AM (#22432427)

It depends on the perspective, in case of SQL I would argue that sanitizing the input is the same as escaping the output, because the query you are sending to the database is the output.

Escaping the output however as a term implies you are doing it right, while sanitizing the input could also mean you just replace("DROP", "") etc. (My last name is Dropmann, I know what I am talking about)

[ Parent | on HN ]

Re:Don’t try to sanitize input – escape output by ashearer on Thursday February 27, 2020 @11:19AM (#22434550)

The difference is where it's done. "Sanitizing the input" implies that it happens when the value is read, so that all uses of the value are stuck with a single result. "Escaping the output", in your example, would happen in the database or its driver, for parameterized queries. HTML output of the same value in the same request would be escaped differently within a function that builds HTML output.

[ Parent | on HN ]