An application needs to handle input and output of untrusted data carefully. As the case may be, values have to be escaped, filtered, validated or sanitized. There often seems to be a sloppy and interchangeable use of these terms although they are obviously not all equivalent.

I'm looking for a clarifying overview about the differences and the correct usage in a security context.

  • 1
    Escaping, filtering, sanitizing = same thing depending on context. Validating = ensuring that input conforms to specific restrictions (length, format, etc). Commented Nov 29, 2016 at 20:27
  • 1
    @MarkBuffalo Apparently others see more differences, though: codex.wordpress.org/…
    – Arminius
    Commented Nov 29, 2016 at 20:29

1 Answer 1


Escaping. Converting a control character to its escape sequence. For example, a < symbol may be converted to &lt; so that the characters following the < are not interpreted as an XML tag instead of XML content.

Filtering. Like escaping, but instead of replacing the control character, it is simply removed.

Validated. Comparison of an input against a white list or regular expression to detect control characters or other character sequences that would trigger an unauthorized behavior. For example, an account number entered by a user might be validated against a list of account numbers known to be tied to the user.

Sanitized. A combination of escaping, filtering, and validation that ensures that an input to a system function does not trigger an unexpected and unauthorized behavior.

  • This matches the general usage I've seen.
    – crovers
    Commented Nov 29, 2016 at 20:32
  • What about "input validation"? Are these all forms of that?
    – Mike B
    Commented Jan 31, 2018 at 16:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .