Home/ Questions/Q 8655311
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-12T14:59:48+00:00

I’ve got a simple question: When is it best to sanitize user input? And

  • 0

I’ve got a simple question:
When is it best to sanitize user input?
And which one of these is considered the best practice:

  1. Sanitize data before writing to database.
  2. Save raw data and sanitize it in the view.

For example use HTML::entities() and save result to database.
Or by using HTML methods in the views because in this case laravel by default uses HTML::entities().
Or maybe by using the both.

EDIT: I found interesting example http://forums.laravel.com/viewtopic.php?id=1789. Are there other ways to solve this?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I would say you need both locations but for different reasons. When data comes in you should validate the data according to the domain, and reject requests that do not comply. As an example, there is no point in allowing a tag (or text for that matter) if you expect a number. For a parameter representing.a year, you may even want to check that it is within some range.
    Sanitization kicks in for free text fields. You can still do simple validation for unexpected characters like 0-bytes. IMHO it’s best to store raw through safe sql (parameterized queries) and then correctly encode for output. There are two reasons. The first is that if your sanitizer has a bug, what do you do with all the data in your database? Resanitizing can have unwanted consequences. Secondly you want to do contextual escaping, for whichever output you are using (JSON, HTML, HTML attributes etc.)

    • 0