Question

I’m working on a CMS and would like to strip all control characters (BEL, NUL, LF, FF) that are submitted from the admin back end before the input is saved to the DB. Rather than call a method to do this each time a save is made in the code, I’d like to do it once.

We do all DB access via a class that wraps DbCommand. I was thinking it would be nice to just loop through all of the parameters’ values and call the method that strips control chars so that it’s implemented in one place and developers wouldn’t have to remember to use the method for new data saving code.

Am I crazy? Is this possible? If not what’s the best way to approach this?

Answer 1

Input sanitization is done by IDbCommand implementations. If you want to perform some more work on parameter string values, why not implement a decorator that implements IDbCommand and performs your validation before delegating execution methods to the inner?