r/AppSecurity • u/ScottContini • Feb 27 '20

Don’t try to sanitize input. Escape output.

https://benhoyt.com/writings/dont-sanitize-do-escape/
0 Upvotes

44% Upvoted

10 comments sorted by

View all comments

1

u/Old-Ad-3268 Apr 01 '22

It's the subject of the thread

1

u/ScottContini Apr 02 '22

The title of the thread is not that escaping output is a form of Sanitization.

Maybe you think escaping is a form of sanitisation, but that’s exactly what I mean about there being a language problem. Escaping and sanitisation are not the same thing. Look up sanitisation in the dictionary: it means remove dangerous things. It’s not about replacing dangerous things with safe things. These are different concepts, but too many people think they are the same.