Re: [tlug] Do you whitelist or blacklist utf-8?

[Shmuel Fomberg <owner@example.com>]

Hi Dave.


> > but first you need to tell us something about your data. is the user
> > allowed to enter HTML tags?
> Nope. I want to be real strict. They get:
> No punctuation at all.
> Only spaces, no other white space (tabs, line feed characters, or
> anything else).
> They can have 0-9a-zA-Z, and anything above the ASCII range (taking into
> account what you wrote above).
Then you are pretty safe from XSS.
All these attacks are basically injecting unwanted html tags to your site.
if you don't allow any pun, then no tags can be injected.

Shmuel.