The tag has no usage guidance.

learn more… | top users | synonyms

-1
votes
2answers
88 views

Is there any danger in rendering user-entered HTML and can it be mitigated?

I'm guessing the answer is no because there's quite a few examples, including right here. If I let users submit their own HTML text and then render it side by side, what could the user do that would ...
1
vote
1answer
157 views

Hypothetical : What restrictions will I need to add to Java so that I can remove its GC? [closed]

This is a hypothetical, yet very technically precise question I'm trying to ask all the compiler/static analysis programmers. I'm trying to understand the extent of prohibitive features I would need ...
2
votes
1answer
872 views

Optimized Special Character Escaper vs Matcher/Pattern

I need to escape special characters which are sent to apache lucent. Since the code will run on a production server I want the code to be the fastest possible. I've seen multiple ways to do it: ...
1
vote
1answer
555 views

pcre case insensitivity: handle escape sequences as raw bytes?

Consider the following regex (no unicode): Example:\x04\x05\x41 Suppose you search this regex case-insensitively. Would you expect it to search the final \x41 in case-sensitive manner? People whom ...
0
votes
2answers
579 views

How does Facebook strip html/apostrophes for XSS but also display it?

I'm not quite sure if this is a question for programmers.se rather than stackoverflow, but here goes. So Facebook [or any other large company] when given something like an apostrophe or html, can ...
1
vote
1answer
889 views

Does it make sense to sanitize email form input?

So, I'm expending this email submission form script for a client and saw something rather strange to my experience. As you can see below, the original programmer has sanitised the user input. Is this ...
1
vote
3answers
195 views

Escaping strings in database layer

Can escaping functions (e.g. mysql_real_esacpe_string ) be moved down to the database layer where we would loop through all parameters passed for all queries and escape all strings. Would that be a ...