What is input validation?
Input validation is the practice of checking every piece of data that enters an application against a definition of what is acceptable, and rejecting what does not fit before the application acts on it. A quantity must be a whole number from 1 to 99, an employee ID is the letter E followed by six digits, a date must parse as a real calendar date, and an uploaded avatar must be a PNG or JPEG under 2 MB. Done well, validation narrows what an attacker can deliver to the parts of an application that do dangerous things: building database queries, running operating system commands, opening files and rendering pages.
Validation has to run on the server
Checks in the browser, through HTML attributes such as required and maxlength or through JavaScript, help honest users fix mistakes quickly. They provide no security, because the attacker controls the browser and can send requests directly with an intercepting proxy, curl or a script. Security-relevant validation runs on the server, every time, for every input. That includes inputs that do not look like input: hidden form fields, drop-down values, cookies, HTTP headers, query strings, JSON and XML bodies, file names and file contents, and data from partner APIs or even from the application's own database when users originally supplied it.
Allow lists beat block lists
Positive validation, also called allow-list validation, defines what good input looks like and rejects everything else. Negative validation tries to recognize bad input, such as <script> or ' OR 1=1, and it loses to alternate encodings, mixed case and syntax its authors never considered. Strong checks are precise: data type, minimum and maximum length, numeric range, a fixed set of permitted values, or a regular expression anchored to the whole string. Decode input to its simplest standard form before checking it, so an encoded payload cannot slip past. And reject rather than repair: code that tries to delete dangerous characters can be tricked into assembling the attack for the attacker.
Example: validating an order lookup
An API endpoint accepts GET /orders?id= followed by an order number. On the server, the code checks that id matches ^[0-9]{1,10}$, returns HTTP 400 for anything else, and only then passes the value to a parameterized query. A tester who sends id=1 UNION SELECT password FROM users gets a 400 response, and the request never reaches the database. Each control covers the other's failure: if the validation were missing, the parameterized query would still keep the SQL safe, and if a developer later concatenated the query by mistake, the validation would still block this field.
Input validation vs. output encoding and parameterized queries
Validation cannot be the whole defense, because many fields legitimately contain characters that are dangerous somewhere: a surname like O'Neil, a support message with angle brackets, a password with almost anything. Output encoding converts data for the place it is written, such as HTML-encoding a comment before inserting it into a page, so the browser displays it as text. Parameterized queries send the SQL statement and the data separately, so input can never change the structure of the query. Validation turns away malformed input early; encoding and parameterization neutralize input that is valid but dangerous in a particular context. A web application firewall in front of the application adds a layer but replaces none of them.
Input validation on the CompTIA Security+ exam
Input validation is one of the application security controls listed under SY0-801 objective 4.1, and it is the standard mitigation for the injection attacks covered under objective 2.5, such as SQL injection, command injection and directory traversal. Wording such as the browser-side check was bypassed with a proxy, letters were accepted in a numeric field or reject data that doesn't match the expected format points to server-side input validation with an allow list. Distractors include client-side validation, which the attacker skips; a block list of bad strings or a filter that strips quotes; and, when script is injected into pages other users view, validation in place of output encoding, which is the primary fix there.