Dark Reading is part of the Informa Tech Division of Informa PLC
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
Special Report: Computing's New Normal, a Dark Reading PerspectiveThis special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
The Threat from the Internet—and What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Tweet This
17 Comments
User Rank: Apprentice
3/4/2019 | 5:34:35 PM
In general, providing an input with an apostrophe should be considered valid, even if the backend uses this value in an SQL query (as the real data being search may have such values, e.g. Name: O'Neill). If I include the text "<grin>" with-in some online forum post/comment, it shouldn't be rejected/removed for no-HTML input fields, but be treated as verbatuim text that is properly escaped in output HTML.
Input validation should normally only be done for specific business logic (e.g. usernames are limited to ASCII letters/numbers and must start with a letter), or general sanity checks (e.g. only ASCII; only valid UTF-8 encoded strings; doesn't contain invalid UNICODE composed sequences; no embedded NUL characters [when using length specified strings]).