Secure Coding Practices for Input Validation
Domain 4: Secure Coding Practices for Input Validation
This domain tests whether you can constrain untrusted input before it reaches sensitive operations. The exam distinguishes validation from output encoding and expects server-side enforcement.
Core rules and concepts
- Validate on the server. Client-side checks improve usability but never enforce security.
- Prefer allowlists for type, length, format, range, and permitted characters. Denylists are brittle because encodings and alternate syntax can bypass them.
- Canonicalize input before validation when the platform supports it, then validate the canonical form. Avoid repeated decoding that creates parser differentials.
- Validate semantically: an age field should be an integer within a defined range, not merely a string without angle brackets.
- Use parameterized queries, safe APIs, and context-appropriate output encoding. Input validation does not replace output encoding.
- Handle file uploads with extension and content checks, size limits, random names, storage outside the web root, and malware scanning.
Worked example
An age field accepts a value used in a database query. A weak implementation checks only that the value is not empty and then concatenates it into SQL. A sound implementation rejects non-digits, converts to an integer, enforces 18 through 120, uses a parameterized query, and returns a generic validation message. The reasoning is layered: allowlist validation rejects unexpected syntax, type conversion enforces semantics, the parameterized query prevents SQL interpretation, and the generic message avoids leaking implementation detail.
Traps that cost marks
Do not validate only on the client. Do not rely on a denylist of quotes and keywords. Do not validate after the value has already been used. Do not confuse input validation with output encoding. Do not decode input twice or trust a content-type header alone.
Testing angle
Try boundary values, null bytes, Unicode variants, overlong input, alternate encodings, and unexpected types. Confirm the server rejects or normalizes them consistently.