Introduction

Input validation is one of the most important secure programming practices.

Every application receives input from users, forms, URLs, files, APIs, databases, cookies, headers, and external systems. If this input is not checked properly, the application may behave incorrectly, crash, store bad data, or become vulnerable to attacks.

A secure program never blindly trusts input. It checks whether the input has the correct type, length, format, range, and business meaning before processing it.

Easy Real-Life Example

School Gate:
Check ID card
Check visitor purpose
Check allowed entry time
Reject unknown visitors

Software Application:
Check input type
Check input length
Check input range
Check input format
Reject invalid input

Input validation works like a gatekeeper for your application. It allows expected data and rejects unsafe or incorrect data.

What is Input Validation?

Input validation is the process of checking data before accepting, storing, processing, or displaying it.

It ensures that only properly formed and expected data enters the application workflow.

Simple Example

Requirement:
Marks must be between 0 and 100.

Input:
marks = 150

Validation:
150 is greater than 100.

Result:
Reject input and show "Invalid marks".

Without validation, the application may calculate wrong results using invalid data.

Why Input Validation is Important

Input validation is important because applications often receive unexpected data. Users may make mistakes, attackers may send harmful input, and external systems may send malformed data.

What Can Go Wrong Without Input Validation?

If input is not validated, the application may accept data that it cannot safely process.

Sources of Input

Input does not only come from forms. Secure programmers must validate data from many sources.

Basic Validation Checks

Input validation usually checks multiple conditions.

Syntactic Validation

Syntactic validation checks whether input has the correct structure or format.

Examples:
- Email should contain valid email structure.
- Date should follow expected date format.
- Phone number should contain expected digits.
- Product code should follow required pattern.
- Postal code should match allowed format.

Syntactic validation answers the question: Is the input written in the correct form?

Semantic Validation

Semantic validation checks whether the value makes sense in the business context.

Examples:
- Start date must be before end date.
- Withdrawal amount must not exceed account balance.
- Product quantity must be available in stock.
- Student marks must be between 0 and 100.
- Discount percentage must not be more than 100.

Semantic validation answers the question: Does the input make sense for this situation?

Syntactic vs Semantic Validation

Allowlist Validation

Allowlist validation means accepting only known safe and expected values.

This is usually safer than trying to block known bad values because attackers may find new ways to bypass blocklists.

Weak Blocklist Thinking

Reject only values that look dangerous.

Problem:
Attackers may use a new pattern that is not blocked.

Better Allowlist Thinking

Accept only values that are expected.

allowedRoles = ["Student", "Teacher", "Admin"]

IF role is in allowedRoles THEN
    ACCEPT role
ELSE
    REJECT role
END IF

Reject Invalid Input

When input fails validation, the application should reject it safely and clearly.

Do not continue processing invalid input.

INPUT quantity

IF quantity is not a number THEN
    DISPLAY "Invalid quantity"
    STOP
END IF

IF quantity <= 0 THEN
    DISPLAY "Quantity must be greater than zero"
    STOP
END IF

PROCESS quantity

Stopping early prevents invalid data from reaching later parts of the program.

Validate on the Server Side

Client-side validation improves user experience, but it should not be treated as the main security control.

Users or attackers can bypass browser checks and send requests directly to the server.

Multi-Level Validation

Multi-level validation means validating data at more than one layer when needed.

Validation Layers:
1. User interface layer
2. API layer
3. Application/business logic layer
4. Database constraints
5. File processing layer

Each layer may validate different things depending on the context.

Length Validation

Length validation checks whether input is too short or too long.

This protects the application from empty values, oversized values, storage problems, and some denial-of-service style risks.

FUNCTION validateUsername(username)
    IF username is empty THEN
        RETURN "Username is required"
    END IF

    IF length of username < 3 THEN
        RETURN "Username is too short"
    END IF

    IF length of username > 20 THEN
        RETURN "Username is too long"
    END IF

    RETURN "Valid username"
END FUNCTION

Range Validation

Range validation checks whether numeric values are within allowed limits.

FUNCTION validateMarks(marks)
    IF marks is not a number THEN
        RETURN "Invalid marks"
    END IF

    IF marks < 0 OR marks > 100 THEN
        RETURN "Marks must be between 0 and 100"
    END IF

    RETURN "Valid marks"
END FUNCTION

Range validation is useful for marks, age, quantity, price, percentage, date limits, and rating values.

Format Validation

Format validation checks whether input follows an expected pattern.

Examples:
- Email format
- Phone number format
- Date format
- Student roll number format
- Product code format
- Postal code format

Example: Roll Number Format

Requirement:
Roll number should start with "STU-" followed by four digits.

Valid:
STU-1001

Invalid:
1001
STUDENT-1001
STU-ABCD

File Upload Validation

File upload validation is important because uploaded files can be misused if the application accepts anything without checking.

Sanitization vs Validation

Validation and sanitization are related, but they are not the same.

Validation and Output Encoding

Input validation checks whether data is acceptable before processing. Output encoding prepares data safely for a specific output context.

Valid input may still need output encoding when shown in HTML, placed in a URL, written in JSON, or used in another context.

Input validation asks:
"Does this value belong here?"

Output encoding asks:
"How should this value be safely displayed or sent?"

Both are useful, but they solve different problems.

Input Validation and Databases

When input is used with databases, validation is important, but validation alone should not be the only defense.

Secure programs should treat user input as data and use safe database handling methods rather than directly combining raw input into database commands.

Unsafe idea:
Directly join user input into database command text.

Safer idea:
Validate input and use parameterized query or safe database method.

Student-Friendly Example: Marks Validation

Bad Code

INPUT marks

IF marks >= 40 THEN
    DISPLAY "Pass"
ELSE
    DISPLAY "Fail"
END IF

This code does not check whether marks is a number or whether marks is between 0 and 100.

Improved Secure Version

INPUT marks

IF marks is not a number THEN
    DISPLAY "Invalid marks"
    STOP
END IF

IF marks < 0 OR marks > 100 THEN
    DISPLAY "Marks must be between 0 and 100"
    STOP
END IF

IF marks >= 40 THEN
    DISPLAY "Pass"
ELSE
    DISPLAY "Fail"
END IF

The improved version validates input before using it.

Real-World Example: E-Commerce Quantity Validation

Bad Code

INPUT quantity
INPUT price

totalAmount = quantity * price

DISPLAY totalAmount

This code does not check whether quantity and price are valid.

Improved Secure Version

INPUT quantity
INPUT price

IF quantity is not a number OR quantity <= 0 THEN
    DISPLAY "Invalid quantity"
    STOP
END IF

IF price is not a number OR price <= 0 THEN
    DISPLAY "Invalid price"
    STOP
END IF

IF quantity > 100 THEN
    DISPLAY "Quantity limit exceeded"
    STOP
END IF

totalAmount = quantity * price

DISPLAY totalAmount

The improved version validates type, range, and business limit before calculation.

Example: Role Validation

Role values should usually be selected from allowed values rather than accepted freely.

allowedRoles = ["Student", "Teacher", "Admin"]

INPUT selectedRole

IF selectedRole is not in allowedRoles THEN
    DISPLAY "Invalid role"
    STOP
END IF

SAVE selectedRole

This prevents unexpected role names from entering the system.

Common Input Validation Mistakes

Best Practices for Input Validation

Prerequisites Before Learning Input Validation

Students should understand the following topics before learning input validation deeply:

Trace Table Example: Validate Marks

FUNCTION validateMarks(marks)
    IF marks is not a number THEN
        RETURN "Invalid marks"
    END IF

    IF marks < 0 OR marks > 100 THEN
        RETURN "Marks must be between 0 and 100"
    END IF

    RETURN "Valid marks"
END FUNCTION

Practice Activity: Add Input Validation

Improve the following pseudocode by adding input validation.

INPUT age

IF age >= 18 THEN
    DISPLAY "Eligible"
ELSE
    DISPLAY "Not eligible"
END IF

Sample Improved Version

INPUT age

IF age is not a number THEN
    DISPLAY "Invalid age"
    STOP
END IF

IF age < 0 OR age > 120 THEN
    DISPLAY "Age must be between 0 and 120"
    STOP
END IF

IF age >= 18 THEN
    DISPLAY "Eligible"
ELSE
    DISPLAY "Not eligible"
END IF

Practice Test Cases

Mini Quiz

Interview Questions on Input Validation

Quick Summary