# FOUT — blocklist: probeer bekende slechte patronen te blokkeren
def sanitize_input(value):
    blacklist = ['<script>', 'DROP TABLE', '../', ';']
    for bad in blacklist:
        value = value.replace(bad, '')
    return value  # Eindeloos te bypassen

# GOED — allowlist: definieer wat WEL mag
import re

def validate_username(value):
    if not re.fullmatch(r'[a-zA-Z0-9_]{3,30}', value):
        raise ValueError("Ongeldige gebruikersnaam")
    return value

# Type-validatie
def validate_age(value):
    age = int(value)          # TypeError als het geen getal is
    if not 0 <= age <= 150:   # Range-check
        raise ValueError("Leeftijd buiten bereik")
    return age

# Format-validatie met regex
import re

def validate_dutch_postcode(value):
    if not re.fullmatch(r'\d{4}\s?[A-Z]{2}', value):
        raise ValueError("Ongeldige postcode")
    return value.replace(' ', '')  # Normaliseer naar '1234AB'

# E-mail: gebruik een library, schrijf geen eigen regex
from email_validator import validate_email

def validate_email_address(value):
    result = validate_email(value)
    return result.normalized

import unicodedata

# 'café' kan op twee manieren gecodeerd zijn:
nfc = unicodedata.normalize('NFC', user_input)   # Samengesteld: é
nfkc = unicodedata.normalize('NFKC', user_input) # Compatibel: fi → fi

# Normaliseer VOOR validatie
def validate_name(value):
    value = unicodedata.normalize('NFC', value)
    if not re.fullmatch(r'[\w\s\-]{1,100}', value, re.UNICODE):
        raise ValueError("Ongeldige naam")
    return value

MAX_COMMENT_LENGTH = 5000

def validate_comment(value):
    if len(value) > MAX_COMMENT_LENGTH:
        raise ValueError(f"Commentaar te lang (max {MAX_COMMENT_LENGTH} tekens)")
    return value.strip()

# Python — standaardbibliotheek
import html

user_input = '<script>alert("XSS")</script>'
safe = html.escape(user_input)
# &lt;script&gt;alert(&quot;XSS&quot;)&lt;/script&gt;

// Java — OWASP Java Encoder
import org.owasp.encoder.Encode;

String safe = Encode.forHtml(userInput);
String safeAttr = Encode.forHtmlAttribute(userInput);
String safeJs = Encode.forJavaScript(userInput);

// JavaScript (server-side Node.js)
const he = require('he');

const safe = he.encode(userInput);

// PHP
$safe = htmlspecialchars($userInput, ENT_QUOTES | ENT_HTML5, 'UTF-8');

// C# — System.Text.Encodings.Web
using System.Text.Encodings.Web;

string safe = HtmlEncoder.Default.Encode(userInput);
string safeJs = JavaScriptEncoder.Default.Encode(userInput);
string safeUrl = UrlEncoder.Default.Encode(userInput);

# Nooit dit:
f"var name = '{user_input}';"  # XSS via '; alert(1); //

# Wel dit:
import json
f"var name = {json.dumps(user_input)};"  # Veilig geëscaped

from urllib.parse import quote, urlencode

# Enkele parameter
safe_param = quote(user_input)

# Meerdere parameters
params = urlencode({'search': user_input, 'page': '1'})
url = f"https://example.com/search?{params}"

# FOUT — string concatenatie
cursor.execute(f"SELECT * FROM users WHERE name = '{name}'")

# GOED — parameterized
cursor.execute("SELECT * FROM users WHERE name = %s", (name,))

// GOED — PreparedStatement
PreparedStatement stmt = conn.prepareStatement(
    "SELECT * FROM users WHERE name = ?");
stmt.setString(1, name);

// GOED — SqlParameter
using var cmd = new SqlCommand(
    "SELECT * FROM users WHERE name = @name", conn);
cmd.Parameters.AddWithValue("@name", name);

import json

# FOUT — handmatige constructie
response = '{"name": "' + user_input + '"}'

# GOED — json.dumps escaped automatisch
response = json.dumps({"name": user_input})

import subprocess

# FOUT — command injection via shell
subprocess.run(f"convert {filename} output.png", shell=True)

# GOED — argumenten als lijst, geen shell
subprocess.run(["convert", filename, "output.png"])

// HTML sanitisatie met DOMPurify
const clean = DOMPurify.sanitize(userInput);

// Met configuratie — alleen bepaalde tags toestaan
const clean = DOMPurify.sanitize(userInput, {
  ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a', 'p', 'br'],
  ALLOWED_ATTR: ['href'],
});

import bleach

# Basis sanitisatie
clean = bleach.clean(user_input)

# Met allowlist
clean = bleach.clean(
    user_input,
    tags=['b', 'i', 'em', 'strong', 'a', 'p', 'br', 'ul', 'ol', 'li'],
    attributes={'a': ['href', 'title']},
    protocols=['https'],
)

# user_input = "<script>"
# Eerste keer: al geëncoded
html.escape(user_input)
# Resultaat: "<script>" — dubbel encoded, zichtbaar als <script>

<!-- GEVAARLIJK — JavaScript in een HTML attribuut -->
<a href="#" onclick="doSomething('{{ user_input }}')">Click</a>

<a href="#" id="action-link" data-value="{{ user_input }}">Click</a>
<script>
  document.getElementById('action-link').addEventListener('click', function() {
    doSomething(this.dataset.value);
  });
</script>

from pydantic import BaseModel, Field, validator

class CreateUserRequest(BaseModel):
    username: str = Field(min_length=3, max_length=30, pattern=r'^[a-zA-Z0-9_]+$')
    email: str = Field(max_length=254)
    age: int = Field(ge=18, le=150)

    @validator('email')
    def validate_email(cls, v):
        # Gebruik een library voor e-mailvalidatie
        if '@' not in v or '.' not in v.split('@')[1]:
            raise ValueError('Ongeldig e-mailadres')
        return v.lower()

@app.post('/api/users')
def create_user(data: CreateUserRequest):
    # data is gevalideerd door Pydantic
    ...

# Beperk querylengtes
MAX_SEARCH_LENGTH = 200

def search_products(query: str):
    query = query[:MAX_SEARCH_LENGTH].strip()
    return db.execute(
        "SELECT * FROM products WHERE name LIKE %s LIMIT 50",
        (f"%{query}%",)
    )

import os

UPLOAD_DIR = '/var/www/uploads'

def safe_save(filename: str, content: bytes):
    # Verwijder pad-componenten
    filename = os.path.basename(filename)

    # Allowlist bestandsextensies
    allowed_ext = {'.pdf', '.png', '.jpg', '.docx'}
    _, ext = os.path.splitext(filename)
    if ext.lower() not in allowed_ext:
        raise ValueError(f"Bestandstype {ext} niet toegestaan")

    # Genereer een veilige bestandsnaam
    import uuid
    safe_name = f"{uuid.uuid4().hex}{ext.lower()}"

    # Controleer dat het pad binnen UPLOAD_DIR blijft
    full_path = os.path.join(UPLOAD_DIR, safe_name)
    if not os.path.realpath(full_path).startswith(os.path.realpath(UPLOAD_DIR)):
        raise ValueError("Pad-traversal gedetecteerd")

    with open(full_path, 'wb') as f:
        f.write(content)
    return safe_name

import subprocess
import shlex

# FOUT — shell injection
def run_tool(target):
    subprocess.run(f"nmap {target}", shell=True)

# GOED — argumenten als lijst
def run_tool(target):
    # Valideer eerst
    import re
    if not re.fullmatch(r'[\w.\-:]+', target):
        raise ValueError("Ongeldig doel")
    subprocess.run(["nmap", target])