Secure Development for Mobile Apps

298

seCure develoPment For mobIle APPs

e regular expression is exactly the same, and the result is the same. is ensures

consistent validation results in the client and in the server.

If instead the PHP function below is used,

return filter_var($string, FILTER_SANITIZE_STRING);

the result can be different than what was allowed client side, and can create difficulty

in tracking down bugs.

Client side validation can be bypassed, so the server has to be diligent in protec-

tive filtering. When client side validation is followed, the server should mimic the

validation rule, not enforce a different one. Another way to put this is that prop-

erly validated client side data should pass through server side validation unaltered.

Data that does not pass successf ...