4 ms·
I think the confusion comes from that not everybody thinks of "passing data to the database layer" as an output, but only an input to the next layer. If you thi
by eandre 7y ago
I think the confusion comes from that not everybody thinks of "passing data to the database layer" as an output, but only an input to the next layer. If you think of this input as an output from the previous layer, then your advice makes perfect sense. But I don't think everyone thinks that way so it might help to clarify what "output" means in this context.
- jessaustin 7y agoNo, that's clearly input. That data shouldn't be sanitized, but it should be passed to the database via parameterized query.