Penetration testers found out that we allow single quotes in submitted data fieldssingle quotes in submitted data fields, and want us to apply rules (input validation) to not allow them in any value.
While I'm aware that single quotes are popular for SQL injection attacks, I strongly disagree that they should not be allowed as valid input (I. I am advocating for actually preventing SQL injection by means of using prepared statementsprepared statements (which properly quote the values) instead of filtering out anything that remotely looks like being an SQL fragment).
My case:
- Person names can contain single quotes (such as O'ReillyO'Reilly)
- Text fields can contain single quotes (such as I'm pretty sureI'm pretty sure)
- Number fields can contain single quotes (EUR 1'000'000EUR 1'000'000)
- and many more
I've seen other cases where applying SQL injection prevention rules dicarded valid data for the silliest reasons (Namename "Andreas" rejected because it contains an AND, and various common words in plain text fields being rejected because they contained the keywords "select", "insert", "update" or "delete").
What's the security professionals' stance on that matter?
Shall we reject implementing input validation for single quotes for the reasons I stated?
