*NEVER* sanitize your inputs

Re:*NEVER* sanitize your inputs by mantrax4 on Monday April 14, 2014 @10:23AM (#7586301)

No form should accept just "HTML" if you don't want just any "HTML" in your form.

I was actively trying to talk about his script example and instead I had to second-guess his parser to get past the validator (I eventually resigned and replaced < and > with [ and ]).

If you want to support some tags, have your parser be an HTML-like DSL language with those tags supported. Don't disallow perfectly good input.

[ Parent | on HN ]

Re:*NEVER* sanitize your inputs by zAy0LfpBZLC8mAC on Monday April 14, 2014 @10:33AM (#7586367)

I don't really understand what point you are trying to make, but in any case, he has a particular input format for that form field, your input did not conform to it, so it was rejected, nothing particularly surprising or wrong there.

Now, I haven't tried it, but I suppose his form field expects HTML syntax? Have you tried entering your text in HTML syntax? Was that rejected?

[ Parent | on HN ]