I think the confusion comes from that not everybody thinks of "passing data to t... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

eandre on Feb 27, 2020 | parent | context | favorite | on: Don’t try to sanitize input – escape output

I think the confusion comes from that not everybody thinks of "passing data to the database layer" as an output, but only an input to the next layer. If you think of this input as an output from the previous layer, then your advice makes perfect sense. But I don't think everyone thinks that way so it might help to clarify what "output" means in this context.

jessaustin on Feb 27, 2020 [–]

No, that's clearly input. That data shouldn't be sanitized, but it should be passed to the database via parameterized query.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact