3 ms·
"So the better approach is to store whatever [data] the user enters verbatim, and then have the template system HTML-escape when outputting HTML" With this log
by gkoberger 5y ago
"So the better approach is to store whatever [data] the user enters verbatim, and then have the template system HTML-escape when outputting HTML"
With this logic, someone could use a SQL injection. It wouldn't be sanitized as the INSERT is happening, so the SQL injection would be executed.
EDIT: I know he goes on to talk about escaping characters, but the title of the post is "Don't try to sanitize input". My point is simply that SQL injections happen on input, not output. His example of escaping the SQL is at odds with the title of the post.
- hombre_fatal 5y agoThey show the solution of using parameterized queries to store the user input verbatim. What is an example of the attack you have in mind?
- jerf 5y agoMost SQL systems have bind parameters for this sort of thing. That is a form of encoding the input. You have to encode the SQL values as well. You're basically saying if you don't use the suggested technique, the suggested technique doesn't work. Well, yeah. It has to be used consistently, all the time, every time. Unfortunately, that's just life. There's no way around it. One way or another you're going to be doing something or you're going to get owned.
- vlovich123 5y agoSorry, how does this happen if you’re using DB parameter in the query string?
- kam 5y agoThey're calling the SQL query "output" (from the app to the DB server). The point is that the "bad characters" depend on the context, so it's the step where you combine trusted and untrusted data that you need to think about escaping or validating.
- gkoberger 5y agoNo they're not. They're using the word "output" to mean "back into the HTML". "So the better approach is to store whatever name the user enters verbatim, and then have the template system HTML-escape when outputting HTML, or properly escape JSON when outputting JSON and JavaScript."
- kam 5y agoThe sentence immediately after that is "And of course use your SQL engine’s parameterized query features so it properly escapes variables when building SQL"