BTW: there is no such thing as generic sanitized string. There may be SQL-escape...

kruhft · on May 25, 2013

Base64 encode a string and it's generically sanitized. They're a bit difficult to read with the naked eye though.

damncabbage · on May 25, 2013

Unless it's in a URL. (This is why URL-safe Base64 versions exist... Which can then in turn be inappropriate for other places.)

mikeash · on May 25, 2013

And base64 can use the / character, so it's unsafe for POSIX filenames.

wglb · on May 25, 2013

Until the next element in the pipeline chain decodes it and you can then have injection.

michaelochurch · on May 25, 2013

Sure. I was just using one example of sanitization: defense against Bobby Tables.