Hacker News Reader

not interested in debating semantics. data is turned from input streams of bytes into coherent structures in your system. the process of turning data into coherent structures is input sanitization. sanitization or validation or conformation - you can argue how to call it and where to use it, but if you don't - your internal bugs will be exploitable externally, good luck.

View on HN

> the process of turning data into coherent structures is input sanitization.

No, that is parsing.

> sanitization or validation or conformation - you can argue how to call it and where to use it

Sanitization is "change to make acceptable", validation is "check for conformance and reject what is non-conforming". The first one is practiced by tons of developers and it's a terrible idea, the latter is what you should do. But also, the latter is never about "dangerous" input, it's only about meaningless input.

Reply on news.ycombinator.com