Little Bobby Tables: Understanding Data Validation and Sanitization
summary
Explains that missing validation and sanitization lets user input become executable SQL and shows the classic drop table students SQL‑injection string as a concrete failure mode, then gives concrete defenses: allow-listing over deny lists, sanitize again at every trust barrier, normalize/escape or encode rather than destructively strip, use established libraries (mentions DOMPurify) and OWASP cheat sheets, and restrict DB privileges so administrative statements cannot run from ordinary app queries.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:49Bobby Tables XKCD comic
- 5:39SQL injection breakdown
- 9:49SQL injection risks
- 11:12Validation vs sanitization
- 14:39Allow vs deny listing
- 17:06Sanitization methods
- 20:56Sanitizing trust barriers
- 22:19Tools and best practices
related talks
59mSecure Coding Back to Basics
52mSecure by Design, Revisited - Insights & Pitfalls
46mThe Path of Secure Software
24mSecuring your site like it's 1999
52mDon't Get Burned! Secure Coding Essentials in Java to protect your application.
46mSecure Coding Patterns
45mSecuring LLM Applications: Overcoming Security & Privacy Challenges
35mPHP is evil (Defensive programming)