Don’t try to sanitize input – escape output

Re:Don’t try to sanitize input – escape output by Joker_vD on Thursday February 27, 2020 @11:49AM (#22434954)

> Sanitize your inputs.

Sadly, there is no "the sanitization". JSON, SQL, HTML, CSS, and URI (and the future formats not invented yet) all require different escape schemes, so while you can indeed filter out anything that can be interpreted as an escape sequence in any of those formats, that's not something you can always do.

Instead, render your data properly (yes, that includes escaping whatever you're outputting).

[ Parent | on HN ]

Re:Don’t try to sanitize input – escape output by tmpz22 on Thursday February 27, 2020 @01:30PM (#22436178)

I particularly enjoy React's dangerouslySetInnerHTML syntax

``` <div dangerouslySetInnerHTML={__html: '<p>hello world</p>'} /> ```

Like they're BEGGING you to never use it but understand sometimes it may be necessary or at least is needed to avoid worse hacks to achieve the same function.

I've taken to using prefixes like DANGEROUS or UNSAFE in various parts of our codebase to better indicate to the user where extra caution is needed.

[ Parent | on HN ]