String Trepanation
String Trepanation


            
    
        
        
            
                
                
                    
                
            
            
                
            
            
    
        
            
                
                    Latest Thoughts
                
                
                
                    Log In
                
            
        
    



        
        
    


            
                
        
            
                
            
            
            
                by glyph
            
            

            




    
    6 thoughts
    
    
        last posted Aug. 30, 2013, 12:45 a.m.
    



            

            
                
            

            

            

            
        
        
            

            

            
                
                    
                    


             0
    





            Let's stop calling it "Sanitization".
            

            
            
        



                    
                    
                    
                    


             0
    





            The issue isn't that the strings are dirty, and you're removing the dirt.  After all, turning "<" into "\<" hasn't removed the objectionable material, it's just transformed it. Made it dirtier, even.
            

            
            
        



                    
                    
                    
                    


             0
    





            The issue is that you want to let the bad thoughts out of the string.
            

            
            
        



                    
                    
                    
                    


             0
    





            ";--\ndrop table users;--"

isn't dirt; it's an active evil, a demon.  You want to get it out of your string by making a little hole near the ";" to let it out.  You're trepanning the string.
            

            
            
        



                    
                    
                    
                    


             0
    





            The nice thing about this metaphor is that in addition to being a more accurate description of what you're doing, it's also a great metaphor about the kind of people who think that this is a good idea, as well as the state of the practice of technology that they are familiar with.
            

            
            
        



                    
                    
                    
                    


             0
    





            Hopefully the next time you see a PHP developer headed for your inputs with some backslashes and extra quotes, you'll have a clear mental picture of a concerned-looking medieval physician headed for you with a nice, sharp corkscrew.
React accordingly.
            

            
            
        



                    
                    
            
        
        
    
            

            
    


        