4 ms·
"using a regex to try and match bad things" And that's the core failure, not the use of regexes. Whatever you are using to filter user input, you always filte
by CrLf 15y ago
"using a regex to try and match bad things"
And that's the core failure, not the use of regexes.
Whatever you are using to filter user input, you always filter the good things in, and not the bad things out.
- ajross 15y agoExactly. For example the common case of filtering "text to be displayed via the web" is probably best expressed as a (1) a validating conversion to utf8 followed by (2) a regex that translates characters outside the safe range to XML entities.