3 ms·
> sanitize real-world, subjective fields like human names, gender, race etc.? The simple answer is _not to_. Use something you can stuff a bunch of arbitrary b
by shakna 6y ago
> sanitize real-world, subjective fields like human names, gender, race etc.?
The simple answer is _not to_. Use something you can stuff a bunch of arbitrary bytes into, that will fit the byte encoding that the system is currently using.
Don't sanitise it. Have no expectations about what it can contain. Have a length, have some bytes, and don't ever dare to try and look inside it.
- hamilyon2 6y agoDepends on what kind of software do you write. When dealing with anything near banking and human life and anything regulated really, I strongly suggest heavily sanitizing all of inputs. No control characters, no invalid utf-8, no weird whitespace and white list characters you want to allow. Actual list is domain-specific, of course. Limiting input field to reasonable 20 characters will help defence in depth too.
- shakna 6y agoAnd that's how you end up with a bank unable to handle the existence of certain people because their legal names exceed character limits, contain unexpected characters, or surprise the programmer in other ways. The legal name must be an exact representation, and appear identically. Sanitising it will break things.