While talking with one of my coworkers, he was talking about the issues the language we used had with encryption/decryption and said that a developer should always salt their own hashes. Another example I can think of is the mysql_real_escape_string in PHP that programmers use to sanitize input data. I've heard many times that a developer should sanitize the data themselves.My question is what things should a developer always do on their own, for whatever reason, and not rely on the standard libraries packaged with a language for it?
What actions should I not rely on the packaged functionality of my language for?
language features
I think you may be confusing core language functionality with features provided by extensions and / or toolkits.I don't know of any cryptographic algorithm that pre-salts a hash for you, which is why your coworker made his comment.  But that cryptography function is not a core aspect of the language, it's part of an extension.In general, you need to understand the tools you are using regardless of their belonging to the core language or being provided through a toolkit.  If the language says it will do X, Y, and Z upon invocation then you can trust the language to do X, Y, and Z when you correctly invoke it.  Any other result would be a bug in the implementation of that language.  That doesn't obviate the need to understand what the function is providing.As a related example, memory allocation in C does not initialize the memory segment to a preset / predetermined value.  You generally need to then set the memory to a predefined value (such as 0x00) prior to using it.  I can trust that when I call for the alloc then the memory was allocated (assuming my returned pointer is non-null).  But the alloc doesn't guarantee it will provide initialized memory, so I need to do that myself.