Security issues on allowing Special characters in input field

Question

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems caused by them, I am taking care of two things -

1. SQL injection - using parameterized queries
2. Cross Site Scripting - HTML escaping user input before adding it to DOM.

Is it sufficient or am I missing something?

EDIT For giving a better context, I am explaining the flow.

In my web application, user input goes directly to a database. It is fetched from the database to create HTML(also setting html elements attributes and styles) and JSON. I am escaping the fetched values from the database while creating HTML.

While creating JSON, I am not escaping those fetched values. This JSON is used by our another application to create HTML. And I am making sure that the values are escaped before inserted into HTML.

Answer 1

There's no such thing as special characters.

It all depends on the context that input is used within your application. Protecting against SQLi and XSS is great, however if the input is then to be used in an operating system shell call it does you no good.

Always encode or sanitize when the data is used - leave this as late as possible. For example when outputting to HTML, HTML encode at this point.

So without knowing all the output points or sinks in your application, it is impossible to say if you are missing something. If all you are doing is inserting data into a database, and outputting it to HTML (not JSON, JavaScript, CSS, etc) then if you do the correct parameterisation and HTML output encoding in the right places you are good as far as XSS and SQLi vulnerabilities go. Doing anything else with the data would require properly encoding, sanitizing or using the correct API depending on the format.

Answer 2

you put user input directly into a DB?... Bad idea (in general).

You should sanitize all Input. (so input coming from the client and input coming from the Database).

You are relying on the Client to make values safe in your example. something you should never fully trust as its outside of your control.

for the rest I defer to @SilverlightFox as his points are all valid and applicable with 1 addition. User input should be sanitized not only on display but before storage as well.