I am working on building an application which will be used in various language , to secure from attacks like xss, SQL injection I thought implementing character filteration (whitelisting/blacking) but not sure if putting validation based on alphanumeric character is best way or not as non English characters might get rejected. what's the right way to handle this?

  • Can you perform injection attacks using non-English characters? You could simply whitelist all non-English.
    – schroeder
    Aug 22 '19 at 6:40
  • Not sure about whether we can actually perform injection with non English characters or not. Also I am expecting input in quiet a few languages. Any idea will output encoding help here?
    – pkm
    Aug 22 '19 at 7:21

Trying to duct tape "more security" by trying to guess what is safe and what is not is going to fail.

The only way to make sure you don't get code injected through input is to treat input as data and never mix it with code, whether it might be safe or not.

  • For SQL that means prepared statements.

  • For XSS attacks it gets a little trickier because there is no such easy option. But the basic rules are the same. Do not mix data and program logic.

So to summarize: Do not try to best-guess what of your input is safe to treat as code. Never treat it as code. Separate code and (input) data and you don't have to worry about other languages and character encodings.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.