Skip to main content
added 514 characters in body
Source Link
Moazzam Khan
  • 123
  • 1
  • 1
  • 5

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems caused by them, I am taking care of two things -

  1. SQL injection - using parameterized queries
  2. Cross Site Scripting - HTML escaping user input before adding it to DOM.

Is it sufficient or am I missing something?

EDIT For giving a better context, I am explaining the flow.

In my web application, user input goes directly to a database. It is fetched from the database to create HTML(also setting html elements attributes and styles) and JSON. I am escaping the fetched values from the database while creating HTML.

While creating JSON, I am not escaping those fetched values. This JSON is used by our another application to create HTML. And I am making sure that the values are escaped before inserted into HTML.

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems caused by them, I am taking care of two things -

  1. SQL injection - using parameterized queries
  2. Cross Site Scripting - HTML escaping user input before adding it to DOM.

Is it sufficient or am I missing something?

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems caused by them, I am taking care of two things -

  1. SQL injection - using parameterized queries
  2. Cross Site Scripting - HTML escaping user input before adding it to DOM.

Is it sufficient or am I missing something?

EDIT For giving a better context, I am explaining the flow.

In my web application, user input goes directly to a database. It is fetched from the database to create HTML(also setting html elements attributes and styles) and JSON. I am escaping the fetched values from the database while creating HTML.

While creating JSON, I am not escaping those fetched values. This JSON is used by our another application to create HTML. And I am making sure that the values are escaped before inserted into HTML.

deleted 8 characters in body
Source Link
SilverlightFox
  • 34.4k
  • 6
  • 73
  • 192

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|{}[];:'"<,.>~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems caused by them, I am taking care of two things -

  1. SQL injection - using parameterized queries
  2. Cross Site Scripting - HTML escaping user input before adding it to DOM.

Is it sufficient or am I missing something?

Thanks

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|{}[];:'"<,.>) in an input field. To mitigate the problems caused by them, I am taking care of two things -

  1. SQL injection - using parameterized queries
  2. Cross Site Scripting - HTML escaping user input before adding it to DOM.

Is it sufficient or am I missing something?

Thanks

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems caused by them, I am taking care of two things -

  1. SQL injection - using parameterized queries
  2. Cross Site Scripting - HTML escaping user input before adding it to DOM.

Is it sufficient or am I missing something?

updated explanation
Source Link
Moazzam Khan
  • 123
  • 1
  • 1
  • 5

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|{}[];:'"<,.>) in an input field. To mitigate the problems caused by them, I am taking care of two things -

  1. SQL injection - using parameterized queries
  2. Cross Site Scripting - HTML escaping user input before adding it to DOM.

Is it sufficient or am I missing something?

Thanks

I am building a web application, in which I am required to let user enter any character(even special characters) in an input field. To mitigate the problems caused by them, I am taking care of two things -

  1. SQL injection - using parameterized queries
  2. Cross Site Scripting - HTML escaping user input before adding it to DOM.

Is it sufficient or am I missing something?

Thanks

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|{}[];:'"<,.>) in an input field. To mitigate the problems caused by them, I am taking care of two things -

  1. SQL injection - using parameterized queries
  2. Cross Site Scripting - HTML escaping user input before adding it to DOM.

Is it sufficient or am I missing something?

Thanks

Source Link
Moazzam Khan
  • 123
  • 1
  • 1
  • 5
Loading