By security principles, we are often taught to sanitize input fields for characters such as
' so that they cannot be used for SQL injections etc.
However, now I have an issue: I really need to store a string input which would contain these characters. It is a business requirement. My code scanners would definitely flag this into a warning alert as this is classic SQL injection vulnerability if I do not sanitize the input. My database would then store the string
& instead of
& (just an example). But this is not what we wanted. We really wanted the literal
' stored in database.
What are the good ways to go about doing this?