Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

There seem to be so many ways to create nefarious input that white-listing what input is good usually feels like the safer, simpler option.

For instance, one can fairly easily craft a white list regex that includes good things [a-zA-Z0-9], but this seems to fall apart quickly when considering international content. To clarify, the simple sample regex above would keep valid English alphabet words, but would strip out, for example, valid Spanish letters with diacritics or Chinese characters.

Is there a best practice for this type of international input validation?

share|improve this question

migrated from Aug 10 '11 at 18:49

This question came from our site for professional and enthusiast programmers.

What are you protecting against? Injected code, naughty words? The above regex won't keep the valid English word "won't." – Mike Samuel Aug 10 '11 at 18:04
Best practices usually involve normalizing the text to Normal Form C before trying to validate or sanitize anything. – Mike Samuel Aug 10 '11 at 18:06
Human written text is nortorously difficult to filter accuratly. – this.josh Aug 10 '11 at 21:09

1 Answer 1

up vote 5 down vote accepted

That's why the character class [[:alnum:]] exists; it includes the characters which are considered valid alphanumerics in the currently active locale. Of course, that doesn't work well on a web server in the US when someone in Egypt is attempting to provide input through a form - and it doesn't work with punctuation. But it also doesn't include spaces, and that may be completely irrelevant.

To more directly answer the question - yes, a whitelist is always preferable. It's not always practical, though. Only someone familiar with the specific application can make the call as to what's actually practical.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.