Don’t try to sanitize input – escape output

Re:Don’t try to sanitize input – escape output by Izkata on Thursday February 27, 2020 @08:30AM (#22433031)

> Input sanitization is strictly checking front-end input against a ruleset and rejecting anything that does not comply.

That's validation. Sanitization involves altering the data to make it safe (comes from the word "sanitary").

[ Parent | on HN ]

Re:Don’t try to sanitize input – escape output by organsnyder on Thursday February 27, 2020 @10:23AM (#22434020)

Rejecting input is a valid sanitization strategy, though.

[ Parent | on HN ]

Re:Don’t try to sanitize input – escape output by SahAssar on Thursday February 27, 2020 @02:27PM (#22436832)

That's not how the word is usually used within development in my experience though.

I think most devs think of sanitization as "make X safe", not "see if X is safe, if not reject" since that is usually called validation.

Using hand sanitizer does not remove your hands if they have harmful bacteria. The hands are still there, just cleaned from (some) of the harmful parts.

[ Parent | on HN ]