Timeline for Security issues on allowing Special characters in input field
Current License: CC BY-SA 3.0
11 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 4, 2016 at 7:54 | comment | added | Silver | Can't this be solved by using prepared statements? The user input will not be able to modify the abstract syntax tree and there will be no issue for SQL injections. This only takes care of SQL injections, if you ever display this data, you need to take care of XSS as well. I would just use XSS preventing libraries for that part. A good library will allow special characters like <, ?, [ but won't allow scripts to be constructed. Take care that the combination of multiple outputs can't generate a script by putting the HTML in between in comment. | |
| Jul 4, 2016 at 7:27 | vote | accept | Moazzam Khan | ||
| May 18, 2015 at 12:08 | answer | added | LvB | timeline score: -2 | |
| May 18, 2015 at 11:04 | history | edited | Moazzam Khan | CC BY-SA 3.0 |
added 514 characters in body
|
| May 18, 2015 at 10:46 | history | edited | SilverlightFox | CC BY-SA 3.0 |
deleted 8 characters in body
|
| May 18, 2015 at 10:46 | answer | added | SilverlightFox | timeline score: 3 | |
| May 18, 2015 at 10:45 | comment | added | Moazzam Khan | Sorry, I wasn't clear, I just updated the post. | |
| May 18, 2015 at 10:45 | history | edited | Moazzam Khan | CC BY-SA 3.0 |
updated explanation
|
| May 18, 2015 at 10:36 | comment | added | LvB | what do you mean "special characters"? does this include characters like \bell and \ff and \n ? | |
| May 18, 2015 at 10:30 | review | First posts | |||
| May 18, 2015 at 11:05 | |||||
| May 18, 2015 at 10:29 | history | asked | Moazzam Khan | CC BY-SA 3.0 |