Input validation and sanitization in Cybersecurity - Time & Space Complexity

Time Complexity: Input validation and sanitization

O(n)

Understanding Time Complexity

When checking user input for safety, the time it takes to validate and clean data matters.

We want to know how the work grows as input size grows.

Scenario Under Consideration

Analyze the time complexity of the following code snippet.

function sanitizeInput(input) {
  let clean = "";
  for (let i = 0; i < input.length; i++) {
    if (input[i] === '<' || input[i] === '>') {
      clean += '';
    } else {
      clean += input[i];
    }
  }
  return clean;
}

This code removes certain characters from the input to prevent harmful data.

Identify Repeating Operations

• Primary operation: Looping through each character of the input string.
• How many times: Once for every character in the input.

How Execution Grows With Input

As the input gets longer, the code checks each character one by one.

Input Size (n)	Approx. Operations
10	About 10 checks
100	About 100 checks
1000	About 1000 checks

Pattern observation: The work grows directly with input size; double the input means double the checks.

Final Time Complexity

Time Complexity: O(n)

This means the time to clean input grows in a straight line with the input length.

Common Mistake

[X] Wrong: "Sanitizing input takes the same time no matter how long the input is."

[OK] Correct: The code checks each character, so longer input means more work and more time.

Interview Connect

Understanding how input size affects validation helps you write secure and efficient code in real projects.

Self-Check

"What if we used a built-in function that removes all unwanted characters at once? How would the time complexity change?"

Practice

1. What is the main purpose of input validation in cybersecurity?

easy

A. To delete all user input after use

B. To check if the data meets expected rules before processing

C. To encrypt data before storing it

D. To backup data regularly

Solution

1. Step 1: Understand input validation

   Input validation means checking if the data entered follows the expected format or rules.

2. Step 2: Identify the purpose in cybersecurity

   This helps prevent harmful or incorrect data from causing problems in the system.

3. Final Answer:

   To check if the data meets expected rules before processing -> Option B

4. Quick Check:

   Input validation = Check data rules [OK]

Hint: Validation means checking data correctness before use [OK]

Common Mistakes:

• Confusing validation with encryption
• Thinking validation deletes data
• Assuming validation backs up data

2. Which of the following is the correct way to sanitize a string input to remove HTML tags?

easy

A. Use a function that strips or escapes HTML tags

B. Convert the string to uppercase

C. Add spaces between characters

D. Store the string as is without changes

Solution

1. Step 1: Understand sanitization

   Sanitization means cleaning input to remove harmful parts like HTML tags that can cause security issues.

2. Step 2: Identify correct sanitization method

   Removing or escaping HTML tags prevents code injection attacks.

3. Final Answer:

   Use a function that strips or escapes HTML tags -> Option A

4. Quick Check:

   Sanitization = Remove harmful parts [OK]

Hint: Sanitize by removing or escaping harmful code [OK]

Common Mistakes:

• Thinking uppercase conversion sanitizes input
• Ignoring the need to remove HTML tags
• Assuming storing input as is is safe

3. Consider this code snippet in a web application:

user_input = ""
safe_input = sanitize(user_input)
print(safe_input)

If sanitize removes all HTML tags, what will be printed?

medium

A. <script>alert('hack')</script>

B.

C. alert('hack')

D. None

Solution

1. Step 1: Understand the input and sanitization

   The input contains HTML script tags which are harmful. The sanitize function removes all HTML tags.

2. Step 2: Determine the output after sanitization

   Removing tags leaves only the text inside: alert('hack').

3. Final Answer:

   alert('hack') -> Option C

4. Quick Check:

   Sanitize removes tags, output = inner text [OK]

Hint: Sanitize removes tags, leaving inner text only [OK]

Common Mistakes:

• Thinking tags remain after sanitization
• Confusing escaped tags with removed tags
• Assuming output is None or empty

4. A developer wrote this code to validate an email input:

def validate_email(email):
    return '@' in email and '.' in email

What is the main problem with this validation?

medium

A. It does not check the position of '@' and '.' properly

B. It encrypts the email instead of validating

C. It removes special characters from the email

D. It always returns False

Solution

1. Step 1: Analyze the validation logic

   The function only checks if '@' and '.' exist anywhere in the string, without checking order or position.

2. Step 2: Identify why this is a problem

   Emails require '@' before '.', and proper format. This simple check allows invalid emails like 'test.@com'.

3. Final Answer:

   It does not check the position of '@' and '.' properly -> Option A

4. Quick Check:

   Validation must check format, not just presence [OK]

Hint: Check positions, not just presence of characters [OK]

Common Mistakes:

• Thinking it encrypts or removes characters
• Assuming it always fails
• Ignoring format rules in validation

5. You receive user input for a username that must be alphanumeric and between 5 to 10 characters. Which approach best combines validation and sanitization?

hard

A. Encrypt input before validating

B. Only remove spaces without checking length or characters

C. Accept input as is and store it directly

D. Check length and characters, then remove spaces and special symbols

Solution

1. Step 1: Understand requirements for username

   The username must be only letters and numbers, and length between 5 and 10 characters.

2. Step 2: Combine validation and sanitization

   Validation checks length and allowed characters; sanitization removes unwanted spaces or symbols.

3. Final Answer:

   Check length and characters, then remove spaces and special symbols -> Option D

4. Quick Check:

   Validate rules + sanitize unwanted parts = safe input [OK]

Hint: Validate rules first, then clean input [OK]

Common Mistakes:

• Skipping validation and sanitization
• Only sanitizing without validation
• Encrypting before checking input