3 ms·
Then that sanitation is incorrect. I don't think this discussion would has any merit if we're speaking about incorrect implementations.
by Avamander 5y ago
Then that sanitation is incorrect. I don't think this discussion would has any merit if we're speaking about incorrect implementations.
- pjerem 5y agoOk, and imagine we are on an Internet forum, talking about what is correct sanitization, and I want to make the following example : <script>alert(42)</script> Will HN remove the <> characters and make my comment incomprehensible or will it escape it on output, preserving all the meaning ? (Well, I’ll know after hitting Reply) Edit : good boy, HN
- nybble41 5y agoYou can't sanitize "correctly" if you don't know where the data will be used. This is exactly why the article advocates for escaping output (e.g. immediately before inserting a string into a SQL query) rather than sanitizing input (e.g. by deleting single-quotes or other potentially problematic characters from strings as soon as they're received).