2.3.4 Sanitize Sensitive Data

import html
import re

def sanitize_input(user_input):
    # Prevent XSS — escape HTML entities
    sanitized = html.escape(user_input)
    # Remove potential SQL injection patterns
    sanitized = re.sub(r"['\";--]", "", sanitized)
    # Trim whitespace
    sanitized = sanitized.strip()
    return sanitized

# BAD — SQL Injection vulnerable
query = f"SELECT * FROM users WHERE id = '{user_input}'"

# GOOD — Parameterized query
cursor.execute("SELECT * FROM users WHERE id = %s", (user_input,))

# SAM template — request validation
MyApi:
  Type: AWS::Serverless::Api
  Properties:
    Models:
      CreateOrderModel:
        type: object
        required:
          - productId
          - quantity
        properties:
          productId:
            type: string
            pattern: "^[a-zA-Z0-9-]+$"
          quantity:
            type: integer
            minimum: 1
            maximum: 100

# CloudFormation
WebACL:
  Type: AWS::WAFv2::WebACL
  Properties:
    DefaultAction:
      Allow: {}
    Rules:
      - Name: RateLimit
        Priority: 1
        Action:
          Block: {}
        Statement:
          RateBasedStatement:
            Limit: 2000
            AggregateKeyType: IP