Hacker News Reader

Comment by hombre_fatal | Hacker News Reader

What are you referring to? The SQL injection example is showing what not to do.

"So the better approach is to store whatever [data] the user enters verbatim, and then have the template system HTML-escape when outputting HTML"

With this logic, someone could use a SQL injection. It wouldn't be sanitized as the INSERT is happening, so the SQL injection would be executed.

EDIT: I know he goes on to talk about escaping characters, but the title of the post is "Don't try to sanitize input". My point is simply that SQL injections happen on input, not output. His example of escaping the SQL is at odds with the title of the post.

They're calling the SQL query "output" (from the app to the DB server). The point is that the "bad characters" depend on the context, so it's the step where you combine trusted and untrusted data that you need to think about escaping or validating.

No they're not. They're using the word "output" to mean "back into the HTML".

"So the better approach is to store whatever name the user enters verbatim, and then have the template system HTML-escape when outputting HTML, or properly escape JSON when outputting JSON and JavaScript."

The sentence immediately after that is "And of course use your SQL engine’s parameterized query features so it properly escapes variables when building SQL"

Most SQL systems have bind parameters for this sort of thing. That is a form of encoding the input. You have to encode the SQL values as well. You're basically saying if you don't use the suggested technique, the suggested technique doesn't work. Well, yeah. It has to be used consistently, all the time, every time.

Unfortunately, that's just life. There's no way around it. One way or another you're going to be doing something or you're going to get owned.

They show the solution of using parameterized queries to store the user input verbatim. What is an example of the attack you have in mind?

Sorry, how does this happen if you’re using DB parameter in the query string?

Reply on news.ycombinator.com