Timeline for Is single quote filtering nonsense?
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 19, 2019 at 20:32 | comment | added | beppe9000 | @Guran If that happens it means someone is bypassing form validation. So either attempt server side normalization to neutral culture (according to expected number type and range) or punish them with a 400 error. Unless you actually want the pain of numbers to be strings, in which case you use libraries, Request Headers, GeoIP and reverse DNS to approximate a locale, and if everything fails send error or parse as neutral. | |
| Feb 19, 2019 at 19:52 | comment | added | Guran | @beppe9000 True. Still, any time you receive string formatted numbers, you are SOL unless you know the culture. | |
| Feb 15, 2019 at 13:44 | comment | added | beppe9000 | @Guran my point is you do form validation on client, then use a neutral culture on server. When you need to display a value in user's culture you format it in js. Storing numbers as strings is just wrong, imho. | |
| Feb 13, 2019 at 9:02 | comment | added | Guran | @beppe9000 So how do you interpret "1,500" without locale information? Fifteen hundred, or one and a half? | |
| Feb 10, 2019 at 14:56 | comment | added | beppe9000 | @jpmc26 Yeah, localization belongs to front end. Data intake only cares about normalization: when serving pages one can use js libraries to format strings according to user preference (wether is stored in the db or as a cookie). | |
| Feb 9, 2019 at 22:32 | comment | added | jpmc26 | @beppe9000 Even easier would be to use a parsing library. It might need to be front end, though, to pick up on the user's locale. | |
| Feb 9, 2019 at 17:25 | comment | added | beppe9000 | @jpmc26 Numbers are easy: an user supplied numeric input string can contain either an integer or a decimal number. For the first one just drop all non-digits and proceed. For decimals I usually look for the first dot or comma character from right to left drop the rest and then replace it with whatever decimal separator is needed and continue. | |
| Feb 9, 2019 at 6:58 | comment | added | jpmc26 | Note that in the locale specific format case, the best answer may not be to disallow it but to parse it somehow and generate the number without it. | |
| Feb 5, 2019 at 10:32 | history | edited | Christoph Burschka | CC BY-SA 4.0 |
typo
|
| Feb 5, 2019 at 9:38 | history | answered | Christoph Burschka | CC BY-SA 4.0 |