Re: Sanitizing text being stored in text fields - some characters cause problems

On 02/24/2012 01:14 PM, Tanstaafl wrote:
> Thanks very much Steve for the candid response, and more importantly
> the links to get us started down the straight and narrow...
>
> I will be taking this all to heart, and have already scheduled a 'come
> to Jesus' meeting for Monday for the Project Manager.

Don't take anyone out to the woodshed. Yet. Though I consider sanitizing
input a basic part of programming, some recent surveys have found that
many if not most college and university programming courses give only a
passing look at security if they discuss security at all.

I have no inkling about the nature of your organization or where you fit
in it. As a general guide, you may be dealing with multiple issues:

1. Lack of experience and training. This can be addressed with
appropriate mentoring, training, etc. The overall development process
can play a role here. Code reviews are a good way of locating problems
and, in the process, educating programmers. You don't want code reviews
to be adversarial but rather team-oriented and educational. Nonetheless,
they fact that someone will be reviewing your code is a deterrent to
taking short-cuts.

2. Laziness and sloppiness. If you have someone who, for whatever
reason, can't be bothered with secure programming then perhaps they need
to find another place to work. Even if they are the "productive"
prima-donna.

3. Misaligned incentives or unrealistic expectations. This is the
hardest to tackle as it requires managerial discipline, patience and
understanding that is both visible and constant. It's easy to have the
"come to Jesus" meeting then immediately slip back into "we have to have
it by tomorrow", "the sales-guy is yelling that his commission is on the
line", "the client needs it yesterday - we'll have to skip the
code-review". It takes managers who will push back and tell their
superiors "we can't have it till end-of-month". Products are visible.
Security isn't.

It takes an understanding that security isn't free. Training and
mentoring take time. Code reviews take time. Testing takes time. But at
least when "Charles O'Leary" visits your site it won't croak and with
luck you will stay off the front page of the Times.

Cheers,
Steve