4 ms·
I agree that prepared statements are much better than sanitising inputs, but surely a sanitised version of his name would be Gijs in \'t Veld Leaving the apostr
by MattBearman 10y ago
I agree that prepared statements are much better than sanitising inputs, but surely a sanitised version of his name would be Gijs in \'t Veld Leaving the apostrophe in tact
- oneeyedpigeon 10y ago"Sanitising" is a vague term and has different meanings depending on context. All it really means, at minimum, is "transforming data, if necessary, to ensure it won't do 'bad stuff'". That might be escaping it, but it could also be stripping certain characters out of it, or just rejecting it altogether.
- jameshart 10y agoyou can't sanitize a name, because a name is not dirty. Sanitization basically means taking a string which purports to conform to a particular grammar, verifying that it does and, if it does not forcing it to. But names don't really have a formal grammar, so you can't 'sanitize' one much (maybe trimming leading and trailing white space and normalizing internal white space runs to a single space? Maybe?). Gijs in \'t Veld is a 'sanitized' string in a grammar which doesn't allow bare apostrophes - such as some string literal syntaxes - and escapes them with a backslash. If someone presents you with a string Gijs in 't Veld with the claim that it conforms to that grammar, they are wrong, and maybe the right thing to do then is to sanitize it as you did. Or you could strip the apostrophe out. Or replace it with a question mark. Your sanitization approach is arbitrary because by definition the string you have been given does not conform to the grammar it purports to so you do not know what to do with that bare apostrophe. Sanitization is not 'representation preserving' because it converts broken, ungrammatical strings (which therefore have undefined meaning) into grammatical strings (which have a defined meaning that you hope is what was intended). But this string hasn't been presented as a string conforming to that grammar. It's been presented as a name, which is essentially an arbitrary valid Unicode string. The process of converting it to the restricted grammar with no bare apostrophes but retaining representation of the same underlying string is not 'sanitization' but 'encoding'. It is representation preserving (so long as the grammar to which we are encoding is capable of representing the string). Failure to grasp the differences between these operations is what causes people to wind up sending people like this poor gentleman emails addressed to Gijs in \%t Veld
- Scarblac 10y agoThat would be silly, then the backslash will be shown everywhere.
- tux3 10y agoI'm not advocating for escape characters instead of proper prepared queries, but in that case you would "simply" need to un-escape the name before showing it.
- paulasmuth 10y agoNo, you don't need to unescape it when displaying it. This SQL literal string: 'Gijs in \'t Veld' Is a representation for these ASCII bytes/content: Gijs in 't Veld In other words. The backslash will not be stored as part of the string into the database. It's just a hint to the SQL parser that the following single quote should be interpreted as a literal single quote char and not as the end-of-string-character. From a security perspective there is nothing more "proper" about prepared queries than correctly escaped non-prepared queries.
- paulasmuth 10y agoI can't tell if you're trolling or not, but this is not how string escaping works in SQL or any other programming language that I know. >> SELECT 'here is an apostrophe: \''; >> returns: here is an apostrophe: ' The backslash is not part of the string but just a hint to the compiler. The literal string '\'' represents a one byte (if ASCII) string containing only a single apostrophe character. https://en.wikipedia.org/wiki/Escape_character https://en.wikipedia.org/wiki/Escape_character