Blacklisting vs whitelisting in the form of input filtering and verification

Question

which is the preferred approach to disinfect user input?

Thank you!

Answer 1

The best approach is to either use stored procedures or parameterized queries. The white list is an additional technique that allows you to prevent any injection before they reach the server, but should not be used as your main protection. A black ad is usually bad because it is usually not possible to filter out all malicious entries.

, , , sql.

Answer 2

WL - BL, .

: , , , , . , , , !

Answer 3

, - , HTML . , symfony 1.x :

class ContactForm extends sfForm  
{  
  protected static $subjects = array('Subject A', 'Subject B', 'Subject C');  

  public function configure()  
  {  
    $this->setWidgets(array(  
      'name'    => new sfWidgetFormInput(),  
      'email'   => new sfWidgetFormInput(),  
      'subject' => new sfWidgetFormSelect(array('choices' => self::$subjects)),  
      'message' => new sfWidgetFormTextarea(),  
    ));  
    $this->widgetSchema->setNameFormat('contact[%s]');  

    $this->setValidators(array(  
      'name'    => new sfValidatorString(array('required' => false)),  
      'email'   => new sfValidatorEmail(),  
      'subject' => new sfValidatorChoice(array('choices' => array_keys(self::$subjects))),  
      'message' => new sfValidatorString(array('min_length' => 4)),  
    ));  
  }  
} 

, , . , . . , , , ...

:

class ContactController {
    /**
    * @input("name", type = "string", singleLine = true, required = false)
    * @input("email", type = "email")
    * @input("subject", type = "string", alternatives = ['Subject A', 'Subject B', 'Subject C'])
    * @input("message", type = "string", range = [4,])
    */
    public function post(Inputs $inputs){
        //automatically validates inputs
        //throws error when an input is not on the list
        //throws error when an input has invalid value
    }
}

/**
* @controller(ContactController)
* @method(post)
*/
class ContactForm extends sfFormX {

  public function configure(InputsMeta $inputs)  
  {
    //automatically binds the form to the input list of the @controller.@method
    //throws error when the @controller.@method.@input is not defined for a widget
    $this->addWidgets(
      new sfWidgetFormInput($inputs->name),  
      new sfWidgetFormInput($inputs->email),  
      new sfWidgetFormSelect($inputs->subject),  
      new sfWidgetFormTextarea($inputs->message)
    );
    $this->widgetSchema->setNameFormat('contact[%s]');  
  }  
}

Answer 4

. , , . . , - "", , .

, , , :) @posterBelow

Answer 5

.

• VS

  . Blacklist XSS SQL Injection . , .

  II. " XSS" " SQL-" . / / , .

• ?

  . . , . , , ?

  II. - . , , - . , - . - , .

  . , , , . , .

Answer 6

, , , , , , , , , - , . , . , , , OWASP "Sanitize with Blacklist":

(, HTML ), "". , . , , , .

, - . XSS "Escape", , , , HTML- , , , , , XSS-. SQL- , , . . , , . , db "", . , , , :

OWASP

OWASP SQL

Answer 7

, , .

(, ) , .

. , , (escape- ..). , - , , .

I think this is just a case of finding a mixture that works for you. I can not come up with a single solution that would work for all the possibilities. It mainly depends on your user base.