Input validation checks that data entering an application is well-formed and safe. The cheat sheet below condenses the OWASP guidance into a quick reference.
| Topic | Key points |
|---|---|
| Goals | Ensure only properly formed data enters a system; validation is a defence-in-depth measure, not a replacement for output encoding. |
| Where to validate | Always validate server-side; client-side validation is for usability only. |
| Allow-list vs block-list | Prefer allow-listing (accept known-good) over block-listing (reject known-bad). |
| Syntactic & semantic | Check both correct form (e.g. a date pattern) and correct meaning (e.g. a plausible date range). |
| Free-form Unicode | Normalise and carefully validate Unicode text to prevent homoglyph and encoding attacks. |
| Uploaded content | Validate file type, size and content; store uploads outside the web root and scan them. |
| Email validation | Validate format conservatively and verify ownership with a confirmation link. |
| Disposable & sub-addressing | Decide whether to allow disposable domains and "+tag" sub-addressing based on your risk profile. |
Ready to strengthen your security?
Talk to our consultants about your penetration testing requirements, or get a fast, transparent quote.