A practical reading of the OWASP Input Validation Cheat Sheet. Accept only the shape you defined, check it on the server, and remember that a valid value is still untrusted when you use it.
Primary source: OWASP Input Validation Cheat Sheet. Pair it with the Query Parameterization Cheat Sheet and the Cross Site Scripting Prevention Cheat Sheet.
Validation decides whether a value is acceptable. Encoding and parameterised queries decide whether it is safe to use.
The check
| Topic | Key points |
|---|---|
| Server side | Repeat the check on the server. A check in the browser only helps the person filling in the form. |
| Allow list | Accept known-good values for fixed fields. A list of banned strings is easy to step around. |
| Form | Check the type, the length and the allowed characters before the value is used. |
| Meaning | A date must be in range, a quantity must be one you can fulfil, and an identifier must belong to this caller. |
| Free text | Normalise Unicode before you compare it. Two strings that look alike can still be different characters. |
| Numbers | Parse to a number, then check the range. A numeric string is still text if you join it into a query. |
| Email and URL | Check the format conservatively. Confirm an email address with a single-use link rather than a clever pattern. |
| Patterns | Keep regular expressions simple. A nested pattern can stall the server on a short input. |
Files and use
| Topic | Key points |
|---|---|
| File type | Allow-list the types you will keep. Detect the content. Do not trust only the extension the client sent. |
| File name | Rename the file on the server. Never write it using a path the client supplied. |
| Size | Cap the upload and reject an oversized body before you parse it. |
| Storage | Keep uploads where the server will not execute them. |
| HTML | Encode for the context you render into. Validation does not replace encoding. |
| Queries | Use parameterised queries. A value that passed validation is still untrusted in SQL. |
| Commands | Do not build a shell command from the input. If you must call out, pass arguments separately from the command. |
| Fail closed | If the check or the parser reports an error, reject the input. Do not continue on a warning. |
What a test should show
- A value the browser would block is still blocked when that check is skipped.
- A well-formed identifier for another customer's record is refused.
- An upload is renamed, and it is not stored on a path the client chose.
- HTML responses are encoded, including values that already passed validation.
- Database calls use parameters.
- An oversized body is rejected before business logic runs.
Ready to strengthen your security?
Talk to our consultants about your penetration testing requirements, or get a fast, transparent quote.