Contents
When to sanitize data in the output context?
Data should be further sanitized on output depending on context. Sanitization involves transforming (possibly destructively) the data to be safe in the output context. Remember that sometimes a single piece of data may be used in multiple contexts on the same page.
Is there a way to sanitize an input string?
There are a multitude of ways to alter an input string in order to remove, replace, or otherwise detect unwanted characters or string patterns. For very simple use-cases, simple solutions will suffice, but for more complex examples, the quick & dirty solutions can become cumbersome, inefficient, or error-prone.
Is there a way to sanitize special chars?
FILTER_SANITIZE_SPECIAL_CHARS works here as well. In addition, all attribute values should be quoted using single or double quotes or you’ll be hit like the examples above. For event handling attributes like onmouseover, onclick, onfocus, onblur or similar, you need to be more careful.
Which is the safest way to sanitize HTML?
Examples include a search results page, a blog commenting system, dictionary.com’s word of the day, etc. In this context, all HTML meta characters need to be encoded or stripped. That’s primarily < and >, but using PHP’s FILTER_SANITIZE_SPECIAL_CHARS is probably safer, and FILTER_SANITIZE_STRIPPED is probably the safest.
What does it mean to clean a dataset?
Also known as data cleansing, it entails identifying incorrect, irrelevant, incomplete, and the “dirty” parts of a dataset and then replacing or cleaning the dirty parts of the data. Although sometimes thought of as boring, data cleansing is very valuable in improving the efficiency of the result of data analysis.
When to use sanitization and escaping user data?
Luckily, there’s a number of handy helper functions you can use for most every data type. Sanitization is a bit more liberal of an approach to accepting user data. We can fall back to using these methods when there’s a range of acceptable input. For instance, if we had a form field like this:
When to filter / sanitize data : before database?
There are at least two types of filtering/sanitization you should care about : Obviously, the first one has to be taken care of before/when inserting the data to the database, to prevent SQL Injections. But you already know that, as you said, so I won’t talk about it more.