2 ms·
> - SQL injection: somebody didn't sanitize the input before querying a database. > - Cross-site scripting: somebody didn't sanitize input and it got submitted
by crazygringo 2y ago
> - SQL injection: somebody didn't sanitize the input before querying a database.
> - Cross-site scripting: somebody didn't sanitize input and it got submitted and executed on behalf of the user.
To be technical about it, this is generally a failure of escaping rather than sanitizing.
You're supposed to be able to put anything into a database field and not have it affect the query. You ought to be able to paste JavaScript into a field and have it be displayed as JavaScript, not executed. The inputs remain as they are -- no sanitization -- they just have to be escaped properly.
That being said, I'm 100% on board about the importance of sanitation/validation. To the extent I think it ought to be part of the design of languages just like types. I.e. if a function parameter is only allowed to be three string values, or a string between 0 and 10 bytes, or a string limited to lowercase ASCII, these should be expressable.