3 ms·
> But my main point was that you need to still think carefully about how you're going to store your data... I think this is true, but doesn't quite reach the p
by nulbyte 7y ago
> But my main point was that you need to still think carefully about how you're going to store your data...
I think this is true, but doesn't quite reach the point GP is making: speaking correctly is also important. Calling parameterization input sanitization communicates the wrong message. And abstracting the wrong solution to apply it to a different problem isn't all that helpful. You could just as easily encode or hash input to fit the underlying data format without losing data (except in the case of truncation), but that isn't input sanitization, either.
Input sanitization is strictly checking front-end input against a ruleset and rejecting anything that does not comply. This is fundamentally different than dealing with anything thrown at you and handling it gracefully.
- Izkata 7y ago> Input sanitization is strictly checking front-end input against a ruleset and rejecting anything that does not comply. That's validation. Sanitization involves altering the data to make it safe (comes from the word "sanitary").
- organsnyder 7y agoRejecting input is a valid sanitization strategy, though.
- SahAssar 7y agoThat's not how the word is usually used within development in my experience though. I think most devs think of sanitization as "make X safe", not "see if X is safe, if not reject" since that is usually called validation. Using hand sanitizer does not remove your hands if they have harmful bacteria. The hands are still there, just cleaned from (some) of the harmful parts.