I am working on building an application which will be used in various language , to secure from attacks like xss, SQL injection I thought implementing character filteration (whitelisting/blacking) but not sure if putting validation based on alphanumeric character is best way or not as non English characters might get rejected. what's the right way to handle this?

  • Can you perform injection attacks using non-English characters? You could simply whitelist all non-English.
    – schroeder
    Commented Aug 22, 2019 at 6:40
  • Not sure about whether we can actually perform injection with non English characters or not. Also I am expecting input in quiet a few languages. Any idea will output encoding help here?
    – pkm
    Commented Aug 22, 2019 at 7:21

1 Answer 1


Trying to duct tape "more security" by trying to guess what is safe and what is not is going to fail.

The only way to make sure you don't get code injected through input is to treat input as data and never mix it with code, whether it might be safe or not.

  • For SQL that means prepared statements.

  • For XSS attacks it gets a little trickier because there is no such easy option. But the basic rules are the same. Do not mix data and program logic.

So to summarize: Do not try to best-guess what of your input is safe to treat as code. Never treat it as code. Separate code and (input) data and you don't have to worry about other languages and character encodings.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .