Don’t try to sanitize input – escape output

Re:Don’t try to sanitize input – escape output by marcosdumay on Thursday February 27, 2020 @04:11PM (#22437933)

If your rules say comments will be truncated to 1000 chars, yo do it on the input. If your rules say all prices are in dollars, but your frontend accepts other currencies, you convert on the input, and overstaff the consumer support.

Honestly, those names mean a lot of different stuff to different people. It's not good that there are so many, it's more a consequence of the widespread of bad practices.

[ Parent | on HN ]

Re:Don’t try to sanitize input – escape output by SahAssar on Thursday February 27, 2020 @05:19PM (#22438572)

I think what people thinking of the term like me (sanitize means modify, validate means accept/reject) will think is that if your rule is "comments will 1000 chars or less", then the validate reasoning would say reject the 1001 chars comment, while the sanitize reasoning would say truncate to 1000 chars.

Do you have a different reading of the terms?

[ Parent | on HN ]