We shouldn't have to sanitize inputs. We should simply make code safe against such inputs. User inputs should never become part of commands except with tools specifically meant for the purpose.
SQL isn't a problem--all user inputs become parameters, they don't get inlined.
I don't see how sanitizing inputs is a bad thing other than additional work, but considering how much dev time gets wasted, I don't think it's a lot to ask.
Multiple layers. Tight code, sanitized inputs, guardrails, etc.
edit: OH YEAH AND ERROR MESSAGES WITH MORE THAN THE FUCKING USELESS,
"An error has occurred. Contact your Systems Admin, so he can be confused too, because we provided fuck all in diagnostic info in the error message!"
Comments
We shouldn't have to sanitize inputs. We should simply make code safe against such inputs. User inputs should never become part of commands except with tools specifically meant for the purpose.
SQL isn't a problem--all user inputs become parameters, they don't get inlined.
I don't see how sanitizing inputs is a bad thing other than additional work, but considering how much dev time gets wasted, I don't think it's a lot to ask.
Multiple layers. Tight code, sanitized inputs, guardrails, etc.
edit: OH YEAH AND ERROR MESSAGES WITH MORE THAN THE FUCKING USELESS,
"An error has occurred. Contact your Systems Admin, so he can be confused too, because we provided fuck all in diagnostic info in the error message!"
The problem comes when you sanitize out something that would be legitimate. Consider SQL--O'Neill will have a problem with you sanitizing his name.