Input validation and sanitization in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why is input validation important in cybersecurity?

Which of the following best explains why input validation is crucial for security?

A It encrypts user input to protect it from hackers.

B It speeds up the processing of data by skipping unnecessary checks.

C It ensures that only expected and safe data is processed, preventing attacks like SQL injection.

D It automatically fixes errors in user input without notifying the user.

💡 Hint

Think about how attackers might use unexpected data to harm a system.

Input validation checks that data matches expected formats and values, stopping harmful inputs that could exploit vulnerabilities.

📋 Factual

intermediate

What is input sanitization?

Choose the correct definition of input sanitization.

A Storing user input in a secure database without changes.

B Rejecting all user inputs that do not match a strict pattern.

C Automatically generating user input based on system defaults.

D Removing or encoding harmful parts of input to make it safe before use.

💡 Hint

Sanitization changes input to remove risks rather than just rejecting it.

Input sanitization modifies input by removing or encoding dangerous characters to prevent security issues.

🚀 Application

advanced

Identify the safest way to handle user input for a web form

You have a web form that accepts usernames. Which approach best protects against malicious input?

A Replace all spaces in usernames with underscores automatically.

B Only accept usernames with letters and numbers, rejecting others.

C Store usernames as entered without checks, but encrypt the database.

D Allow any characters but escape them before displaying on the page.

💡 Hint

Think about limiting input to expected characters to reduce risk.

Restricting input to letters and numbers prevents many injection attacks by disallowing unexpected characters.

🔍 Analysis

advanced

What is the risk of missing input validation on a login form?

Analyze the potential consequences if a login form does not validate or sanitize input.

A Attackers could inject code to bypass authentication or steal data.

B There is no risk because login forms only accept usernames and passwords.

C The server will automatically block suspicious inputs without validation.

D Users might enter longer usernames than allowed, causing display issues.

💡 Hint

Consider how attackers exploit unfiltered inputs to harm systems.

Without validation, attackers can insert malicious code to bypass security or access sensitive information.

❓ Reasoning

expert

Which input sanitization method best prevents cross-site scripting (XSS)?

Given these methods, which one most effectively stops XSS attacks?

A Encoding special characters like <, >, and & before displaying user input.

B Removing all HTML tags from user input but leaving special characters intact.

C Allowing HTML but filtering out script tags only.

D Validating input length to be less than 100 characters.

💡 Hint

Think about how browsers interpret special characters in HTML.

Encoding special characters prevents browsers from treating input as code, effectively stopping XSS.

Practice

1. What is the main purpose of input validation in cybersecurity?

easy

A. To delete all user input after use

B. To check if the data meets expected rules before processing

C. To encrypt data before storing it

D. To backup data regularly

Solution

1. Step 1: Understand input validation

   Input validation means checking if the data entered follows the expected format or rules.

2. Step 2: Identify the purpose in cybersecurity

   This helps prevent harmful or incorrect data from causing problems in the system.

3. Final Answer:

   To check if the data meets expected rules before processing -> Option B

4. Quick Check:

   Input validation = Check data rules [OK]

Hint: Validation means checking data correctness before use [OK]

Common Mistakes:

• Confusing validation with encryption
• Thinking validation deletes data
• Assuming validation backs up data

2. Which of the following is the correct way to sanitize a string input to remove HTML tags?

easy

A. Use a function that strips or escapes HTML tags

B. Convert the string to uppercase

C. Add spaces between characters

D. Store the string as is without changes

Solution

1. Step 1: Understand sanitization

   Sanitization means cleaning input to remove harmful parts like HTML tags that can cause security issues.

2. Step 2: Identify correct sanitization method

   Removing or escaping HTML tags prevents code injection attacks.

3. Final Answer:

   Use a function that strips or escapes HTML tags -> Option A

4. Quick Check:

   Sanitization = Remove harmful parts [OK]

Hint: Sanitize by removing or escaping harmful code [OK]

Common Mistakes:

• Thinking uppercase conversion sanitizes input
• Ignoring the need to remove HTML tags
• Assuming storing input as is is safe

3. Consider this code snippet in a web application:

user_input = ""
safe_input = sanitize(user_input)
print(safe_input)

If sanitize removes all HTML tags, what will be printed?

medium

A. <script>alert('hack')</script>

B.

C. alert('hack')

D. None

Solution

1. Step 1: Understand the input and sanitization

   The input contains HTML script tags which are harmful. The sanitize function removes all HTML tags.

2. Step 2: Determine the output after sanitization

   Removing tags leaves only the text inside: alert('hack').

3. Final Answer:

   alert('hack') -> Option C

4. Quick Check:

   Sanitize removes tags, output = inner text [OK]

Hint: Sanitize removes tags, leaving inner text only [OK]

Common Mistakes:

• Thinking tags remain after sanitization
• Confusing escaped tags with removed tags
• Assuming output is None or empty

4. A developer wrote this code to validate an email input:

def validate_email(email):
    return '@' in email and '.' in email

What is the main problem with this validation?

medium

A. It does not check the position of '@' and '.' properly

B. It encrypts the email instead of validating

C. It removes special characters from the email

D. It always returns False

Solution

1. Step 1: Analyze the validation logic

   The function only checks if '@' and '.' exist anywhere in the string, without checking order or position.

2. Step 2: Identify why this is a problem

   Emails require '@' before '.', and proper format. This simple check allows invalid emails like 'test.@com'.

3. Final Answer:

   It does not check the position of '@' and '.' properly -> Option A

4. Quick Check:

   Validation must check format, not just presence [OK]

Hint: Check positions, not just presence of characters [OK]

Common Mistakes:

• Thinking it encrypts or removes characters
• Assuming it always fails
• Ignoring format rules in validation

5. You receive user input for a username that must be alphanumeric and between 5 to 10 characters. Which approach best combines validation and sanitization?

hard

A. Encrypt input before validating

B. Only remove spaces without checking length or characters

C. Accept input as is and store it directly

D. Check length and characters, then remove spaces and special symbols

Solution

1. Step 1: Understand requirements for username

   The username must be only letters and numbers, and length between 5 and 10 characters.

2. Step 2: Combine validation and sanitization

   Validation checks length and allowed characters; sanitization removes unwanted spaces or symbols.

3. Final Answer:

   Check length and characters, then remove spaces and special symbols -> Option D

4. Quick Check:

   Validate rules + sanitize unwanted parts = safe input [OK]

Hint: Validate rules first, then clean input [OK]

Common Mistakes:

• Skipping validation and sanitization
• Only sanitizing without validation
• Encrypting before checking input