Re:Don’t try to sanitize input – escape output
by SahAssar on Thursday February 27, 2020 @02:06PM
(#22436609)
I think what you are saying is to validate, not sanitize.
Sanitize (as I have understood it) usually means to "modify to be safe", while you are talking about rejecting invalid responses.
Re:Don’t try to sanitize input – escape output
by marcosdumay on Thursday February 27, 2020 @04:11PM
(#22437933)
If your rules say comments will be truncated to 1000 chars, yo do it on the input. If your rules say all prices are in dollars, but your frontend accepts other currencies, you convert on the input, and overstaff the consumer support.
Honestly, those names mean a lot of different stuff to different people. It's not good that there are so many, it's more a consequence of the widespread of bad practices.
Re:Don’t try to sanitize input – escape output
by SahAssar on Thursday February 27, 2020 @05:19PM
(#22438572)
I think what people thinking of the term like me (sanitize means modify, validate means accept/reject) will think is that if your rule is "comments will 1000 chars or less", then the validate reasoning would say reject the 1001 chars comment, while the sanitize reasoning would say truncate to 1000 chars.
Do you have a different reading of the terms?
That's why you do them at different times...
Let's go to the example:
> This is clearly dangerous input!
That's not clear at all. There is a set of values allowed for a comment, this one is probably within them, while, for example, an empty value usually isn't, as isn't and invalid UTF8 sequence. This one should pass sanitization as is.
> Change < to < in the database?
You escape it when converting into HTML. It's not the same as sanitization.