Re:Don’t try to sanitize input – escape output
by Izkata on Thursday February 27, 2020 @08:30AM
(#22433031)
> Input sanitization is strictly checking front-end input against a ruleset and rejecting anything that does not comply.
That's validation. Sanitization involves altering the data to make it safe (comes from the word "sanitary").
Re:Don’t try to sanitize input – escape output
by organsnyder on Thursday February 27, 2020 @10:23AM
(#22434020)
Rejecting input is a valid sanitization strategy, though.
Re:Don’t try to sanitize input – escape output
by SahAssar on Thursday February 27, 2020 @02:27PM
(#22436832)
That's not how the word is usually used within development in my experience though.
I think most devs think of sanitization as "make X safe", not "see if X is safe, if not reject" since that is usually called validation.
Using hand sanitizer does not remove your hands if they have harmful bacteria. The hands are still there, just cleaned from (some) of the harmful parts.
I think this is true, but doesn't quite reach the point GP is making: speaking correctly is also important. Calling parameterization input sanitization communicates the wrong message. And abstracting the wrong solution to apply it to a different problem isn't all that helpful. You could just as easily encode or hash input to fit the underlying data format without losing data (except in the case of truncation), but that isn't input sanitization, either.
Input sanitization is strictly checking front-end input against a ruleset and rejecting anything that does not comply. This is fundamentally different than dealing with anything thrown at you and handling it gracefully.