I don't see how sanitizing inputs is a bad thing other than additional work, but considering how much dev time gets wasted, I don't think it's a lot to ask.
Multiple layers. Tight code, sanitized inputs, guardrails, etc.
edit: OH YEAH AND ERROR MESSAGES WITH MORE THAN THE FUCKING USELESS,
"An error has occurred. Contact your Systems Admin, so he can be confused too, because we provided fuck all in diagnostic info in the error message!"
Comments
I don't see how sanitizing inputs is a bad thing other than additional work, but considering how much dev time gets wasted, I don't think it's a lot to ask.
Multiple layers. Tight code, sanitized inputs, guardrails, etc.
edit: OH YEAH AND ERROR MESSAGES WITH MORE THAN THE FUCKING USELESS,
"An error has occurred. Contact your Systems Admin, so he can be confused too, because we provided fuck all in diagnostic info in the error message!"
The problem comes when you sanitize out something that would be legitimate. Consider SQL--O'Neill will have a problem with you sanitizing his name.