Re: How do I test safe form input?

From: Reply Via Newsgroup (reply-to-newsgroup_at_please.com)
Date: 03/13/04 

Date: Sat, 13 Mar 2004 05:24:07 GMT

Joshua Beall wrote:

> You should also keep in mind that the things you want to be careful for very
> with the context of the form. If it is something you are going to echo back
> to the browser, you do not care if somebody uses a semicolon; the semicolon
> is a legitimate punctuation mark. On the other hand, if this is getting
> passed to MySQL or something else that attributes special meaning to the
> semicolon, then need to be careful.
>
> What I am saying is, in order to make sure your form is safe, you have to
> consider the context. So, what are you trying to do with this form? Is it
> going to be a used in a SQL query or what?
>
>

Yes Yes Yes!

At last - someone who seems to know where I am comming from - This is
specifically what I am concerned about (that characters might be
mis-interpreted as a command as opposed to ordinary data). I believe I
have managed to cover my ass but I'd like to test, safely.

Any ideas?

Relevant Pages

  • Re: echo a string that contain <? and <?php
    ... I should have put the question in the context. ... In fact, the string is ... received from user's input to the form of a browser. ... > echo htmlspecialchars; ...
    (comp.lang.php)
  • Re: Pure client-side javscript database?
    ... the individual asking the question in their single context. ... in the current browser instance and a respondent assumes the question ... >>> that the client may download an application from a server ... >>> server, but the APPLICATION may or may not be. ...
    (comp.lang.javascript)
  • Re: Use of the Registry was Re: Conext Menus
    ... You simply decide what context menus you want for a given application, ... Registry and Context-Menus. ... I didn't know what 'Context-Menu' meant but was aware of Pop-Up Menus - ... Browser incompatibility is the bane of Web programming. ...
    (comp.lang.cobol)
  • Re: CORRECTION omniOrb server + java client
    ... Your server code is creating a new context, ... root context, and then binding the object "Echo" into the new context. ...
    (comp.object.corba)
  • Re: Google Chrome
    ... One would hope that a web browser doesn't need more than one core's ... cores, ... but only important if you haven't got enought CPU to ... one would hope that the context switching overhead ...
    (uk.comp.sys.mac)