• 1 Post
  • 1.04K Comments
Joined 3 years ago
cake
Cake day: June 17th, 2023

help-circle

















  • Which means the app was crap. Rather the rules it used to validate a valid name are garbage.

    Usually because someone tried to be too strict. E.g. names are space delimited A-Za-z strings, rather than just accepting any old Unicode string and safely processing it (e.g. with an SQL prepared statement).

    I’ve had websites reject email addresses with one of the newish TLD’s because someone decided they new how to validate an email address (it’s more a more flexible spec than you might think).


  • That’s conforming (to what ever criteria). Send me a UTF-16 string of at most 100 code points. Send me a 7-bit ASCII string of only A-Z0-9. Reject anything that doesn’t comform.

    sanitizing is trying to clean an input. That’s “lemme just double escape some special characters” or stripping/replacing/encoding characters or truncating strings, coercing types. Don’t do this, your sanitization code will have bugs or edge cases.