> Steve I agree with you on this one. Both input validation and output encoding > are countermeasures to the same basic problem -- that some of the parts of > your string of data may get treated as control structures instead of just as > data. For the purpose of this email I'm using a definition of "input
while I am being persuaded that you can use input validation and output encoding interchangeably as countermeasures for *some* problems documented here, there is another important dimension: enforcement of business rules. In this domain, I do not see an alternative to input validation. kr, Yo -- Johan Peeters http://johanpeeters.com _______________________________________________ Secure Coding mailing list (SC-L) SC-L@securecoding.org List information, subscriptions, etc - http://krvw.com/mailman/listinfo/sc-l List charter available at - http://www.securecoding.org/list/charter.php SC-L is hosted and moderated by KRvW Associates, LLC (http://www.KRvW.com) as a free, non-commercial service to the software security community. _______________________________________________
