2 ms·

Anything and I mean fucking ANYTHING to prevent devs from having to sanitize inputs. smfh.

• LorenPechtel 3y ago
  We shouldn't have to sanitize inputs. We should simply make code safe against such inputs. User inputs should never become part of commands except with tools specifically meant for the purpose. SQL isn't a problem--all user inputs become parameters, they don't get inlined.
  • sonicanatidae 3y ago
    I don't see how sanitizing inputs is a bad thing other than additional work, but considering how much dev time gets wasted, I don't think it's a lot to ask. Multiple layers. Tight code, sanitized inputs, guardrails, etc. edit: OH YEAH AND ERROR MESSAGES WITH MORE THAN THE FUCKING USELESS, "An error has occurred. Contact your Systems Admin, so he can be confused too, because we provided fuck all in diagnostic info in the error message!"
    • LorenPechtel 3y ago
      The problem comes when you sanitize out something that would be legitimate. Consider SQL--O'Neill will have a problem with you sanitizing his name.