4 ms·
>>You normally remove all hints of HTML tags on input sanitation Then what happens when you want to use that input in an excel export? PDF export? CSV file? Te
by nommm-nommm 10y ago
>>You normally remove all hints of HTML tags on input sanitation
Then what happens when you want to use that input in an excel export? PDF export? CSV file? Text file? How about if you want to use it in an HTML attribute? In a URL? Export the database elsewhere? (Such as a credit card company reporting to the CSAs). You can't assume that your data is going to be inside an HTML page between tags always because that mucks up your data. Data should be able to be used in many different ways because it will be and should not be tied to HTML.
- vollmond 10y agoOk, this is the comment that best explained it to me -- you want to sanitize (escaped, etc, whatever) output because, even if you sanitize all HTML/CSS/JS on input, they might have inserted malicious Excel scripts or PDF exploits, etc, that eventually do get executed in an output context.