3 ms·
> sanitize their inputs. For anyone confused about why "sanitizing your inputs" isn't the right approach, please read (shameless self-promotion, but I think th
by benhoyt 5y ago
> sanitize their inputs.
For anyone confused about why "sanitizing your inputs" isn't the right approach, please read (shameless self-promotion, but I think the concept is important): https://benhoyt.com/writings/dont-sanitize-do-escape/ https://benhoyt.com/writings/dont-sanitize-do-escape/
- ineedasername 5y agoI've pretty much always taken 'sanitize' as a catch-all for all of the things you need to do.
- benhoyt 5y agoFair enough on that part. But it's the "their inputs" part that's just as problematic: whatever massaging you do to your "inputs", they'll always be unsafe in some contexts. You need to encode/escape your output.