0

I have always found it more logic to validate input instead of filtering it. How to appropriately filter data depends on the situation, so IMO it should be done in output or when saving to a database.

But I see that some frameworks provide automatic XSS filters for incoming POST and GET data. What is the logic behind this solution? I can't see any advantages in doing this except providing a quick and easy solution to "lazy" developers.

Or is there some specific security reason I don't understand?

Improve this question
2
  • Preference to go with is - data validation in client and server sides, filter out before input/rendering.
    – Yusubov
    Commented Jul 18, 2012 at 16:01
  • It stops developers that never heard of XSS from creating vulnurable sites.
    – Patrick
    Commented Jul 18, 2012 at 19:02

2 Answers 2

Reset to default
3

I wouldn't say frameworks provide XSS filtering because developers are "lazy." They do it so developers can focus on the creating code specifically for their application. A developer's job is hard enough handling the (sometimes) baffling business rules applications have to enforce.

Let's say you were an expert carpenter. Given enough time you can build anything. You have a job to redo someone's kitchen. Should you spend a good chunk of time making the best hammer in the world? Or, should spend your time redoing the kitchen and use the $20 hammer you can pick up at Lowe's?

The company that makes hammers focuses all their energy on making the best hammers they can. The people who make the frameworks focus their energy on making the best frameworks they can. They can spend their time testing and retesting that code because that is what they focus on. When you have to roll your own you may miss something or create a bug you could never think of. Sometimes you have to create your own hammer (or code) to meet a very specific need, but hopefully that is few and far between.

Improve this answer
2
  • I agree that it is better to buy a hammer rather than building one. But why are some famous hammers made in a different way? Why do they apply filters at input level instead of providing, for example, a 'safe_echo()' function?
    – lortabac
    Commented Jul 19, 2012 at 8:31
  • If I had to venture a guess it is probably because they want something like that locked down by default, to prevent less experienced developers from causing huge security problems. I think back to the developer I was at the very start of my career and chances are I would have made a mistake like that. Framework makers have to sometimes write for the lowest common denominator, which causes some headaches for the more experienced developers.
    – bwalk2895
    Commented Jul 19, 2012 at 14:02
0

My preference is to always validate input and filter output. Filtering input will often save time and help the lazy, but it's always possible your output filtering will need to change or you'll want to analyze the raw data for security or statistical reasons.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.