Re: Automated Form Validation?
From: Chung Leong (chernyshevsky_at_hotmail.com)
Date: 02/26/05
- Next message: Chung Leong: "Re: PHP - Does it ignore return val from constructors?"
- Previous message: juglesh: "Re: calling included remote functions"
- In reply to: Matt Mitchell: "Re: Automated Form Validation?"
- Next in thread: Matt Mitchell: "Re: Automated Form Validation?"
- Reply: Matt Mitchell: "Re: Automated Form Validation?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Sat, 26 Feb 2005 00:07:24 -0500
"Matt Mitchell" <m_a_t_t_remove_the_underscores@metalsponge.net> wrote in
message news:CqvTd.218039$K7.23269@fe2.news.blueyonder.co.uk...
> I would refute this "sane programming scenario" right at the point where
you
> decide that user-inputted data is fine to insert into a database without
> escaping. On which particular planet is this a good idea? If you are
> taking even basic precautions against attacks, then you escape ALL data
> before putting it into the database - even down to things like making sure
> that numeric fields contain numeric data, etc.
That's a bit unfair, isn't it? I would, of course, every argument arguing
against the ideal scenario. Everything would be honky dorry be if everyone
follows best practice et al. What guarantee can you give that best practice
was followed, given that, as you said below, people are proned to err? And
keep in mind that validation has a direct bearing on security. If your
assertion that everything was coded according to best practice turned out to
be untrue, then you have all sort of holes in your application.
> But in the vast majority of cases, the validation IS generic. Most
computer
> software, most people, and most businesses handle the same type of data
> repeatedly; computers are useful because they are good at doing the same
> task over and over and over again, exactly the same each time. People are
> very bad at doing this, and that's why it's better to get something right,
> and then let a computer handle getting it done right the next time.
If that's true, then the validation rules aren't going to change. So you're
back to square one.
- Next message: Chung Leong: "Re: PHP - Does it ignore return val from constructors?"
- Previous message: juglesh: "Re: calling included remote functions"
- In reply to: Matt Mitchell: "Re: Automated Form Validation?"
- Next in thread: Matt Mitchell: "Re: Automated Form Validation?"
- Reply: Matt Mitchell: "Re: Automated Form Validation?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
|
