3 ms·
Not sure why you're being downvoted. Probably because a lot of the people doing so have only worked in small startups. In a larger org the data you have may en
by strictnein 7y ago
Not sure why you're being downvoted. Probably because a lot of the people doing so have only worked in small startups.
In a larger org the data you have may end up in a lot of places you didn't expect. Integrated into systems both new and decades old.
- hombre_fatal 7y agoI've worked on systems so shitty that some input was triple-escaped so that it would trickle down three unescape layers in old buggy clients deployed to the field. The thing is, there's no wisdom to take away from this monstrosity. It's just old shitty legacy ad-hoc code. The grandparent post thinks there is. That you might need to break every rule in the book to integrate shit-tier software doesn't need to be said when talking about software best practices.
- hamilyon2 7y agoAlways filter, not escape. Escaping input is of course path to nowhere, because you never know what kind of context your data will be displayed in. So, you cannot guess proper escaping rules. Escaping data on input is novice mistake. Not having unfiltered data, reject data not conforming to some rules, so you know exactly what to expect getting you somewhere. You can bake checks and constraints into your database model too if it is needed.