Re:Don’t try to sanitize input – escape output
by NohatCoder on Thursday February 27, 2020 @08:34AM
(#22433064)
A method I have generally found useful is to make a whitelist of safe characters (something like alphanumeric, comma, dot and space), and escape everything else. You might escape a bunch of stuff that technically didn't need escaping, but the method is simple, rock solid, and doesn't mangle anyone's names.
[ Parent
| on HN ]
Re:Don’t try to sanitize input – escape output
by DuckyC on Thursday February 27, 2020 @08:42AM
(#22433118)
My name contains Ø, and im guessing i would not be able to enter that with your method. I would consider that mangling my name if i had to write o or oe.
Re:Don’t try to sanitize input – escape output
by NohatCoder on Thursday February 27, 2020 @10:39AM
(#22434182)
No, escape means keep, in HTML for instance Ø would become Ø escaped, but it is still there visible, same as every other character.
Re:Don’t try to sanitize input – escape output
by hombre_fatal on Thursday February 27, 2020 @12:23PM
(#22435389)
This kind of thinking is how your users end up getting emails from your buggy service like "Hello Østein & friends, ..." and your JSON API consumers encounter the same silly output.
Don't escape input. Escape based on output. Escaping doesn't mean anything until you've also specified an output format. It's not always HTML.
Re:Don’t try to sanitize input – escape output
by NohatCoder on Thursday February 27, 2020 @04:17PM
(#22438002)
You are grossly misrepresenting my post, I have said nothing about whether the escaping should be applied to input or output, please edit or delete your comment.