全面的服务器端验证

Question

I currently have a fairly robust server-side validation system in place, but I'm looking for some feedback to make sure I've covered all angles. Here is a brief outline of what I'm doing at the moment:

• Ensure the input is not empty, or is too long

• Escape query strings to prevent SQL injection

• Using regular expressions to reject invalid characters (this depends on what's being submitted)

• Encoding certain html tags, like <script> (all tags are encoded when stored in a database, with some being decoded when queried to render in the page)

Is there anything I'm missing? Code samples or regular expressions welcome.

Answer 1

You shouldn't need to "Escape" query strings to prevent SQL injection - you should be using prepared statements instead.

Ideally your input filtering will happen before any other processing, so you know it will always be used. Because otherwise you only need to miss one spot to be vulnerable to a problem.

Don't forget to encode HTML entities on output - to prevent XSS attacks.