12 ms·

Because if someone wants to register with the name O'Malley, you should not refuse them, or worse, mangle their name.

Avamander 5y ago
Then that sanitation is incorrect. I don't think this discussion would has any merit if we're speaking about incorrect implementations.
- pjerem 5y ago
  Ok, and imagine we are on an Internet forum, talking about what is correct sanitization, and I want to make the following example : <script>alert(42)</script> Will HN remove the <> characters and make my comment incomprehensible or will it escape it on output, preserving all the meaning ? (Well, I’ll know after hitting Reply) Edit : good boy, HN
- nybble41 5y ago
  You can't sanitize "correctly" if you don't know where the data will be used. This is exactly why the article advocates for escaping output (e.g. immediately before inserting a string into a SQL query) rather than sanitizing input (e.g. by deleting single-quotes or other potentially problematic characters from strings as soon as they're received).
1970-01-01 5y ago
If someone wants to register with the username O'Malley and password O`Malley, would you let them?
- simonw 5y ago
  That's not sanitization, that's validation. You implement a validation rule that says that the password and the username can't be the same thing, then use that to redisplay the registration form with an error message.
  - 1970-01-01 5y ago
    Sometimes, you just sanitize input for user reasons. The username and password above are different ASCII strings. The non-tech savvy (very elder) user does not know the difference between "`" and "'" which means they are locked-out. This results in phone calls to support, which in volume result in "fix the password field" See https://www.cl.cam.ac.uk/~mgk25/ucs/apostrophe.html https://www.cl.cam.ac.uk/~mgk25/ucs/apostrophe.html
    - simonw 5y ago
      I'd call that normalization rather than sanitization, but that's my own personal terminology, not necessarily terminology that's widely used.

Then that sanitation is incorrect. I don't think this discussion would has any merit if we're speaking about incorrect implementations.

pjerem 5y ago
Ok, and imagine we are on an Internet forum, talking about what is correct sanitization, and I want to make the following example : <script>alert(42)</script> Will HN remove the <> characters and make my comment incomprehensible or will it escape it on output, preserving all the meaning ? (Well, I’ll know after hitting Reply) Edit : good boy, HN
nybble41 5y ago
You can't sanitize "correctly" if you don't know where the data will be used. This is exactly why the article advocates for escaping output (e.g. immediately before inserting a string into a SQL query) rather than sanitizing input (e.g. by deleting single-quotes or other potentially problematic characters from strings as soon as they're received).

1970-01-01 5y ago

If someone wants to register with the username O'Malley and password O`Malley, would you let them?

simonw 5y ago
That's not sanitization, that's validation. You implement a validation rule that says that the password and the username can't be the same thing, then use that to redisplay the registration form with an error message.
- 1970-01-01 5y ago
  Sometimes, you just sanitize input for user reasons. The username and password above are different ASCII strings. The non-tech savvy (very elder) user does not know the difference between "`" and "'" which means they are locked-out. This results in phone calls to support, which in volume result in "fix the password field" See https://www.cl.cam.ac.uk/~mgk25/ucs/apostrophe.html https://www.cl.cam.ac.uk/~mgk25/ucs/apostrophe.html
  - simonw 5y ago
    I'd call that normalization rather than sanitization, but that's my own personal terminology, not necessarily terminology that's widely used.