Re: Byte Addressability And Beyond

On Wed, 29 May 2024 18:42:32 -0000 (UTC), John Levine
<johnl@taugh.com> wrote:

According to EricP  <ThatWouldBeTelling@thevillage.com>:

Ok, you accept international character data, you just don't have to
check >127 characters for "drop table" etc commands.
>
I don't think you are being paranoid enough.
I still think you have to validate or sanitize the >127 string to
ensure the code sequences only contain well formed characters.

>
If you're sending the strings to a database, the database will
invariably do detailed string validation so I wouldn't bother, but be
prepared for the error code if it rejects the string,

Far too much SQL is constructed by simply splicing user input into a
query "template" string.

When queries are done right with all user input provided via SQL
parameters, then there is far less need to "sanitize" input.

There is a one major caveat: in SQL, table names can't be specified by
parameter.  If the user must provide a table name, then you DO have to
splice the query string and you DO have to be careful.