input-sanitization
Installation
SKILL.md
Input Sanitization
Validate on client (UX). Validate and sanitize on server (security). Never trust user input.
1. Attack Vectors
| Attack | Description | Prevention |
|---|---|---|
| XSS | Inject scripts via user input | Escape output, CSP, DOMPurify |
| SQL Injection | Inject SQL via input | Parameterized queries, ORM |
| NoSQL Injection | Inject operators ($where) |
Validate + sanitize |
| CSRF | Forged requests | SameSite cookies, CSRF tokens |
| Path Traversal | ../etc/passwd in filenames |
Sanitize file paths |
| Command Injection | Shell commands in input | Avoid shell, use safe APIs |
| ReDoS | Catastrophic regex | Avoid complex regex on input |