Secure Coding for Input Validation Flashcards

Which input validation approach is generally considered the most secure?

Answer: Whitelisting allowed characters, formats and ranges

Whitelist (allow-list) validation accepts only input that matches a known-good pattern. That makes it much harder to bypass than blacklists, which miss new or encoded attack strings. Client-side checks are easy to get around and must always be repeated on the server.

What is the primary defense against SQL injection in Java or .NET applications?

Answer: Using parameterized queries (PreparedStatement / SqlParameter)

Parameterized queries keep the query structure separate from the data, so user input can never be read as SQL. A stored procedure that builds dynamic SQL by concatenating input is still vulnerable.

Why should input be canonicalized before it is validated?

Answer: To reduce input to its simplest standard form so encoded attack strings can't slip past validation

Attackers use alternate encodings (URL encoding, double encoding, Unicode) to hide malicious payloads. Canonicalization decodes input to one standard form first, so validation checks the real value.

Which control best prevents stored cross-site scripting (XSS)?

Answer: Context-aware output encoding when the data is rendered

Encoding output for its context (HTML body, attribute, JavaScript, URL) makes the browser treat user data as text rather than executable script. It works alongside input validation.

An application builds a file path from a user-supplied filename. Which attack is most likely if the input is not validated?

Answer: Path (directory) traversal

Without validation, sequences like '../' let an attacker step out of the intended directory and read or write arbitrary files on the server.

Where must security-critical input validation always be enforced?

Answer: On the server side, at a trusted boundary

Attackers control the client and can bypass browser checks with a proxy. Validation that matters for security has to happen on the server at the trust boundary. A WAF adds defense in depth but does not replace it.