Input Validation & Secure Coding
Any input coming from outside your system is potentially dangerous. Server-side validation (allow-lists rather than deny-lists), output encoding and sanitisation, parameterised queries against SQL injection, and prevention strategies against cross-site scripting (XSS) are the first line of defence for practically any application — practical measures you'll reuse in almost every piece of code you write.
Starting Points
- OWASP Cheat Sheet Series. Input Validation Cheat Sheet.
- OWASP Cheat Sheet Series. SQL Injection Prevention Cheat Sheet.
- OWASP Cheat Sheet Series. Cross Site Scripting (XSS) Prevention Cheat Sheet.
- Secure coding practices
Key Points
- You implement server-side input validation for key fields (login, registration, data entry) using allow-lists for format, length, and type.
- You apply output encoding and sanitisation in HTML/JS contexts so user-supplied content renders safely, without stored or reflected XSS.
- You use parameterised queries or ORM parameter binding for all database access, and can explain why this mitigates SQL injection compared to string concatenation.
- You review a small code sample for common insecure patterns (unsanitised input, string-built SQL, unsafe HTML injection) and propose concrete, secure replacements.