Questions tagged [escaping]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
2
votes
2answers
223 views

Should REST API return escaped user generated content

We have a REST API that returns user generated content from a database. Before inserting the data into the database the data is sanitized. But when returning the data we do not escape / decode the ...
3
votes
1answer
592 views

Which is a more efficient approach to decoding escape sequences in text?

I'm working on parsers that not only process delimited content, but also escape sequences within certain portions of that content. I'm contemplating the efficiency of several approaches to ...
2
votes
0answers
469 views

Tainted String Type in Kotlin

Two of the top 3 security vulnerabilities in the OWASP Top 10 come from trusting user input (Injection and XSS). To deal with this, Ruby lets you "taint" Strings received from the user as unsafe. In ...
0
votes
3answers
349 views

How to escape regexes and paths in double quote strings without going crazy?

It often happens that after designing my regexp (on regex101.com) I want to paste it in my program. Consider this regexp that matches numbers and string (but keep in mind this is general question!): ^...
-1
votes
2answers
125 views

Is there any danger in rendering user-entered HTML and can it be mitigated?

I'm guessing the answer is no because there's quite a few examples, including right here. If I let users submit their own HTML text and then render it side by side, what could the user do that would ...
2
votes
1answer
2k views

Optimized Special Character Escaper vs Matcher/Pattern

I need to escape special characters which are sent to Apache Lucene. Since the code will run on a production server, I want the code to be the fastest possible. I've seen multiple ways to do it: ...
1
vote
1answer
1k views

pcre case insensitivity: handle escape sequences as raw bytes?

Consider the following regex (no unicode): Example:\x04\x05\x41 Suppose you search this regex case-insensitively. Would you expect it to search the final \x41 in case-sensitive manner? People whom I ...
0
votes
2answers
948 views

How does Facebook strip html/apostrophes for XSS but also display it?

I'm not quite sure if this is a question for programmers.se rather than stackoverflow, but here goes. So Facebook [or any other large company] when given something like an apostrophe or html, can ...
2
votes
1answer
1k views

Does it make sense to sanitize email form input?

So, I'm expending this email submission form script for a client and saw something rather strange to my experience. As you can see below, the original programmer has sanitised the user input. Is this ...
2
votes
3answers
201 views

Escaping strings in database layer

Can escaping functions (e.g. mysql_real_esacpe_string ) be moved down to the database layer where we would loop through all parameters passed for all queries and escape all strings. Would that be a ...