Sanitize user input

Question

I am learning Angular and have a form that users can book a hotel. This posts to a 3rd party API.

I understand xss and ng-bind-html when the data is outputted back to the view but how do you strip a form or input box of malicious code before the form is sent to the API?

I know Laravel has a sanitize function that you can wrap in your model beforehand.

$sce and $sanitize from what I can see only deals with the view? Or does Angular handle this out of the box?

I think it's better to sanitize from server side. Not from client side. If you do not call the api directly from client side. — Partha Sarathi Ghosh
– Partha Sarathi Ghosh, Commented Feb 24, 2016 at 14:27

Gabriel Kohen · Accepted Answer · 2016-07-18 14:52:47Z

3

It's best if you sanitize both on the client and server.

Server side because: You can't trust a Javascript client that can be modified through the JS console of the browser. In addition someone can send a POST/PUT request mimicking your client using cURL.
Client side because: faster response and first line of defense allowing you to sanitize and value or warn about it without doing a lengthier round trip to the server. You should be including the ngSanitize module and the angular-sanitize.js script in order for value sanitazation to take place automatically.

https://docs.angularjs.org/api/ngSanitize https://www.google.com/about/appsecurity/learning/xss/#PreventingXSS

answered Jul 18, 2016 at 14:52

Gabriel Kohen

4,3264 gold badges34 silver badges47 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Sanitize user input

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related