Lesson 6 of 6 · About 6 minutes
Treat application input as untrusted
Learn the concept.
A form field is a suggestion to the browser, not a promise to the server. Applications need rules for what they accept and safe handling for where the values go next.
Three separate boundaries
Fictional reservation: quantity 2, note <b>Hello</b>.
- Validate
Accept only a whole-number quantity from 1 to 5.
- Authorize
Check that this caller may make the reservation.
- Display safely
Show the note as text, including its brackets.
Read the visualA browser number field limits quantity to 5. What should the server do?
A visitor can send values outside the interface’s limits. The server must validate the received value itself.
Validate for the actual task
Our fictional reservation accepts a whole-number quantity from 1 to 5. A server must enforce that rule even if the page shows a number picker. Rejecting an invalid quantity helps preserve the business rule.
Keep data separate from instructions
A note containing <b>Hello</b> can be displayed as literal text. Do not treat a visitor’s text as trusted HTML. Use context-appropriate output handling; database queries need their own protection, such as parameterized queries.
Do not ask one defense to do everything
Input validation does not replace output encoding, authorization, or safe database access. Text that is valid for one field can still be unsafe if interpreted as code somewhere else.
Put it in context
Try a quantity of 9 in the lab: the fictional server refuses it. Then reserve 2 with the note <b>Hello</b>. The request succeeds, and the note appears literally, including its brackets. It does not turn into page markup.
Make a decision.
Explore the practice space, then answer the check-in below. A correct answer lets you save this lesson to your progress.
YOUR PRACTICE SPACE
Try the idea for yourself.
Enable JavaScript to explore this fictional exercise. The explanation and visual above remain available.
Take this with you.
Validate the meaning of input and keep it as data wherever it travels.
Explore a career track