Sanitize user input: Difference between revisions

=={{header|Phix}}==

As noted there is no magic "one size fits all" solution, and in the specific

case of sql the use of sqlite3_prepare() and sqlite3_bind_text() is strongly

recommended in preference to sqlite3_exec() or sqlite3_get_table(), at

least for any questionable input.

The inverse problem recently arose in p2js, whereby otherwise perfectly

valid code on desktop/Phix could and would generate invalid HTML/Javascript

if and when we tried to self-host (an effort which is still very much in progress, albeit not apace, btw):

<!--<lang Phix>(phixonline)-->

<span style="color: #008080;">with</span> <span style="color: #008080;">javascript_semantics</span>

<span style="color: #004080;">string</span> <span style="color: #000000;">header</span> <span style="color: #0000FF;">=</span> <span style="color: #008000;">"""

&lt;!DOCTYPE html&gt;

&lt;html lang="en" &gt;

&lt;head&gt;

&lt;title&gt;%%s&lt;/title&gt;%s

&lt;/head&gt;

&lt;body&gt;

&lt;scr!ipt src="p2js.js"&gt;&lt;/scr!ipt&gt;%%s%s

"""</span>

<span style="color: #000080;font-style:italic;">-- ...</span>

<span style="color: #000000;">header</span> <span style="color: #0000FF;">=</span> <span style="color: #7060A8;">substitute</span><span style="color: #0000FF;">(</span><span style="color: #000000;">header</span><span style="color: #0000FF;">,</span><span style="color: #008000;">"scr!ipt"</span><span style="color: #0000FF;">,</span><span style="color: #008000;">"script"</span><span style="color: #0000FF;">)</span>

<span style="color: #7060A8;">puts</span><span style="color: #0000FF;">(</span><span style="color: #000000;">1</span><span style="color: #0000FF;">,</span><span style="color: #000000;">header</span><span style="color: #0000FF;">)</span> <span style="color: #000080;font-style:italic;">-- (make the example runnable)</span>

<!--</lang>-->

In other words I had to "santize" a constant in the source code, in this particular case, and I could have gone further and done something similar with all the other tags.