4 ms·

It’s really easy to write PHP, which means that people who don’t know about escaping input write PHP. While there are some web-focussed languages (vs framework

by muglug 7y ago

It’s really easy to write PHP, which means that people who don’t know about escaping input write PHP. While there are some web-focussed languages (vs frameworks) that deliberately make it hard for you to write that sort of code, barely anyone uses them.

colshrapnel 7y ago
"escaping input" is a notorious delusion. And a bad one. - it is not "input" must be treated, but, so to say - output. It's the destination that matters, not the source. By the time you get the input, you have no idea how and where it will be used. You can tell it right before the output (or, rather, better to call it "use") only. Say, you've got some input that didn't pass the verification and you will have to display it back in the HTML form. And if you already "escaped" it for SQL, it will be malformed. And vice-versa. Moreover, any data must be formatted properly before use, not just something that you tagged as "input". - the word treated above is for a reason. Because the term "escaping" suggests some certain routine in PHP, which is the actual reason for numerous SQL injections.
- muglug 7y ago
  You're right, my wording was inexact - we must always escape strings that can be controlled in some fashion by the user. I'm working on comprehensive taint analysis for PHP[0], and I'm spending a bunch of time thinking about how to automatically detect those dirty strings. [0] https://psalm.dev/articles/psalm-3-and-a-half#taint-analysis https://psalm.dev/articles/psalm-3-and-a-half#taint-analysis
horizone 7y ago
> It’s really easy to write PHP, which means that people who don’t know about escaping input write PHP. Not trying call you out on this point, more it made me laugh. Our lead developer strips out characters that break his XML importer (lets just say they are standard common characters, heck, he changes chr(13) to a string so he can switch it back later because he doesn't know how to handle multiple lines in an XML value). People who don't know how to escape inputs / actually handle data properly are in every language. We cringe on a daily basis.

by muglug 7y ago

colshrapnel 7y ago

"escaping input" is a notorious delusion. And a bad one. - it is not "input" must be treated, but, so to say - output. It's the destination that matters, not the source. By the time you get the input, you have no idea how and where it will be used. You can tell it right before the output (or, rather, better to call it "use") only. Say, you've got some input that didn't pass the verification and you will have to display it back in the HTML form. And if you already "escaped" it for SQL, it will be malformed. And vice-versa. Moreover, any data must be formatted properly before use, not just something that you tagged as "input". - the word treated above is for a reason. Because the term "escaping" suggests some certain routine in PHP, which is the actual reason for numerous SQL injections.

muglug 7y ago
You're right, my wording was inexact - we must always escape strings that can be controlled in some fashion by the user. I'm working on comprehensive taint analysis for PHP[0], and I'm spending a bunch of time thinking about how to automatically detect those dirty strings. [0] https://psalm.dev/articles/psalm-3-and-a-half#taint-analysis https://psalm.dev/articles/psalm-3-and-a-half#taint-analysis

horizone 7y ago

> It’s really easy to write PHP, which means that people who don’t know about escaping input write PHP. Not trying call you out on this point, more it made me laugh. Our lead developer strips out characters that break his XML importer (lets just say they are standard common characters, heck, he changes chr(13) to a string so he can switch it back later because he doesn't know how to handle multiple lines in an XML value). People who don't know how to escape inputs / actually handle data properly are in every language. We cringe on a daily basis.