WebApp Sec: Re: ISA Server and SQL Injection

[christopher () baus net]

> 2. Output validation is much better then Input validation, because most
> problems are related to incorrectly encoding input parameters into
> output. In addition proper output encoding allows to use critical
> characters like < > within the application. This is especially important
> in back-office applications.
I don't totally agree with that.  If the input injection allows the
attacker to select a different parameter, it may already be too late for
output validation.  Worse, there maybe nothing the output validator can do
if the result is encoded validly.

Christopher Baus

========
Implementing an HTTP proxy?
Consider a fast, secure alternative
http://www.baus.net/