That’s just awful security practices. You must not replace proper code/data separation with user input sanitization. If you are just pulling names from a database and inserting them into your DOM directly you’re doing things majorly wrong and half your codebase probably needs rewriting from scratch.
If your stack does not support code/data separation, you should at escape at the point of use/point of interface with other software, not at the point of user data entry.
You should not “sanitize” something as personal as a name. It is up to the individual to identify themselves as they see fit, whether it is some weird legal name or just how they want to present.
Getting rid of excess whitespace is fine aswell as it does not change the name
As a responsible developer you must not assume this. Especially if your software interacts with other systems. You never know what dumb shit some other system has got up to, maybe a clerk somewhere accidentally entered someone’s name with a space and that person desperately needs to use your software while they’re getting things fixed.
So many places do these things wrong and just make wild assumptions based on their limited PoV.
I just spent a month adding international phone, name, and postal code support to a legacy app at my job.
They weren’t even consistent with their enforcement inside of the app.
Don’t add validation for anything unless you understand 100% of the cases. You should use premade libraries or tools in most cases because you will do it incorrectly.
That’s just awful security practices. You must not replace proper code/data separation with user input sanitization. If you are just pulling names from a database and inserting them into your DOM directly you’re doing things majorly wrong and half your codebase probably needs rewriting from scratch.
If your stack does not support code/data separation, you should at escape at the point of use/point of interface with other software, not at the point of user data entry.
You should not “sanitize” something as personal as a name. It is up to the individual to identify themselves as they see fit, whether it is some weird legal name or just how they want to present.
As a responsible developer you must not assume this. Especially if your software interacts with other systems. You never know what dumb shit some other system has got up to, maybe a clerk somewhere accidentally entered someone’s name with a space and that person desperately needs to use your software while they’re getting things fixed.
100% this.
So many places do these things wrong and just make wild assumptions based on their limited PoV.
I just spent a month adding international phone, name, and postal code support to a legacy app at my job.
They weren’t even consistent with their enforcement inside of the app.
Don’t add validation for anything unless you understand 100% of the cases. You should use premade libraries or tools in most cases because you will do it incorrectly.
The rules around passwords are equally as dumb