Posted Jun 30, 2011 7:57 UTC (Thu) by dlang (✭ supporter ✭, #313)
Parent article: Sanitizing log file output
in the case of escaping characters, another reason to whitelist instead of blacklist is that the resulting code is shorter (allow a handful of control characters, then everything above a particular value is a printable character vs a growing case of 'if the value is X' point conditions)
I have seen strange things happen when control characters hit a terminal that's not expecting them (including commands getting executed), I've seen this happen due to the terminal and the system sending data to that terminal having different opinions on what character encoding is in use,it doesn't take malicious people to cause problems.