Don’t try to sanitize input – escape output

Re:Don’t try to sanitize input – escape output by reflectiv on Thursday February 27, 2020 @11:57AM (#22435054)

> Input sanizitation doesn't work, because it doesn't know what is dangerous and what is not dangerous.

This is only true if you write or use shitty validation rules. You act like its impossible to do it right...it is not.

[ Parent | on HN ]

Re:Don’t try to sanitize input – escape output by bcrosby95 on Thursday February 27, 2020 @12:02PM (#22435116)

This has absolutely nothing to do with shitty validation rules. It has to do with what you're outputting it as.

If you're outputting it to HTML, commas are fine. If you're outputting it to CSV, commas are bad. And your validation rules suck if you don't allow commas in any text field because it might be output to CSV someday.

[ Parent | on HN ]

Re:Don’t try to sanitize input – escape output by the8472 on Thursday February 27, 2020 @12:03PM (#22435132)

Unicode RTL override can be dangerous in filenames (in the sense of confusing humans, not computers). It is necessary to preserve in content management systems dealing with bidi content.

Of course you can try to have different validations on your model, but then you need to make sure to know all output domains on the model level instead of doing it when handing over to the view.

[ Parent | on HN ]