Sanitization and why validation is not escaping
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
know the limits of validation.
Planned topics
- Validation accepts or rejects; it does not make data safe for every use.
- Output must be escaped for where it lands (HTML, SQL, logs). SQL uses parameters, covered in JNR-P4 and JNR-041.
- Do not silently "clean" input in surprising ways; reject clearly.
- A whitelist (allowed characters) is safer than a blacklist.
Draft outline details
Demonstration
a name field containing <script>; validation may allow it; the output layer must still escape it.
Check your understanding
Does passing validation mean data is safe to put in HTML?
Show answer
No; escape on output.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.