What Is Input Validation?
Input validation is the practice of checking that incoming data matches what a program expects — the right type, length, format, and range — before doing anything with it. It is a foundational hygiene control, but it is widely misunderstood: validation reduces risk, yet it is not the primary defense against injection, and treating it as one leaves real gaps.
Allowlist or blocklist?#
There are two philosophies, and only one is reliable:
- Allowlist (positive) validation — define exactly what is acceptable and reject everything else. “A username is 3–20 letters and digits.” Anything outside that is refused.
- Blocklist (negative) validation — try to enumerate what is bad and block it. “Reject
input containing
<script>.” This always misses variants attackers find.
Allowlisting wins because describing good input is a solvable problem, while predicting every malicious input is not — attackers only need one case you forgot.
Why isn’t validation enough to stop injection?#
Because whether input is dangerous depends on where it is used. The same apostrophe is harmless in a name field and catastrophic in a hand-built SQL query. That is why injection is defeated at the point of use:
| Threat | Real defense | Validation’s role |
|---|---|---|
| SQL injection | Parameterized queries | Defense in depth |
| XSS | Context-aware output encoding | Defense in depth |
| Buffer overflow | Bounds checking / memory safety | Reject oversized input |
Input validation is a core secure coding habit. More at the Security Fundamentals hub.
Frequently asked questions#
What is the difference between allowlist and blocklist validation?
Allowlist validation permits only input that matches known-good patterns and rejects everything else. Blocklist validation tries to enumerate and block bad input, which always misses cases attackers discover. Allowlisting is strongly preferred because defining what is acceptable is far more reliable than predicting every bad thing.
Does input validation prevent injection attacks?
It helps but is not the primary defense. Injection is best stopped at the point of use — parameterized queries for SQL, output encoding for HTML — because the same input is safe in one context and dangerous in another. Validation is defense in depth on top of context-aware handling, not a replacement for it.