Input validation and sanitization in Cybersecurity - Mini Project: Build & Apply

Input Validation and Sanitization

📖 Scenario: You are working on a simple web form that collects user information. To keep the system safe, you need to make sure the input data is checked and cleaned before using it.

🎯 Goal: Build a step-by-step process to validate and sanitize user input data to prevent common security issues.

📋 What You'll Learn

Create a dictionary with user input data

Add a configuration variable for allowed characters

Write logic to validate and sanitize the input

Complete the process by marking inputs as safe or unsafe

💡 Why This Matters

🌍 Real World

Input validation and sanitization are essential to protect websites and applications from harmful data that can cause errors or security breaches.

💼 Career

Understanding how to validate and sanitize input is a key skill for cybersecurity professionals, web developers, and software engineers to ensure safe and reliable software.

1

Create user input data dictionary

Create a dictionary called user_input with these exact entries: 'username': 'john_doe!', 'email': '[e-mail]', 'age': '25'

Cybersecurity

# Create the user_input dictionary with the specified entries
# Your code here

Hint

Use curly braces to create a dictionary with keys and values exactly as shown.

2

Add allowed characters configuration

Create a variable called allowed_chars and set it to the string 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_@.' to specify which characters are allowed in inputs.

Cybersecurity

user_input = {'username': 'john_doe!', 'email': '[e-mail]', 'age': '25'}
# Define allowed_chars string with letters, digits, underscore, @, and dot
# Your code here

Hint

Use a string variable to list all allowed characters exactly as shown.

3

Validate and sanitize user input

Create a new dictionary called sanitized_input. Use a for loop with variables key and value to iterate over user_input.items(). For each value, create a new string containing only characters found in allowed_chars. Assign this cleaned string to sanitized_input[key].

Cybersecurity

user_input = {'username': 'john_doe!', 'email': '[e-mail]', 'age': '25'}
allowed_chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_@.'
# Create sanitized_input dictionary and clean each value
# Your code here

Hint

Use a dictionary comprehension or a loop to filter each input value by allowed characters.

4

Mark inputs as safe or unsafe

Create a dictionary called input_status. Use a for loop with variables key and value to iterate over user_input.items(). For each key, compare value with sanitized_input[key]. If they are equal, set input_status[key] to 'safe', otherwise set it to 'unsafe'.

Cybersecurity

user_input = {'username': 'john_doe!', 'email': '[e-mail]', 'age': '25'}
allowed_chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_@.'
sanitized_input = {}
for key, value in user_input.items():
    cleaned = ''.join(char for char in value if char in allowed_chars)
    sanitized_input[key] = cleaned
# Create input_status dictionary and mark inputs safe or unsafe
# Your code here

Hint

Compare original and sanitized values to decide if input is safe or unsafe.

Practice

1. What is the main purpose of input validation in cybersecurity?

easy

A. To delete all user input after use

B. To check if the data meets expected rules before processing

C. To encrypt data before storing it

D. To backup data regularly

Solution

1. Step 1: Understand input validation

   Input validation means checking if the data entered follows the expected format or rules.

2. Step 2: Identify the purpose in cybersecurity

   This helps prevent harmful or incorrect data from causing problems in the system.

3. Final Answer:

   To check if the data meets expected rules before processing -> Option B

4. Quick Check:

   Input validation = Check data rules [OK]

Hint: Validation means checking data correctness before use [OK]

Common Mistakes:

• Confusing validation with encryption
• Thinking validation deletes data
• Assuming validation backs up data

2. Which of the following is the correct way to sanitize a string input to remove HTML tags?

easy

A. Use a function that strips or escapes HTML tags

B. Convert the string to uppercase

C. Add spaces between characters

D. Store the string as is without changes

Solution

1. Step 1: Understand sanitization

   Sanitization means cleaning input to remove harmful parts like HTML tags that can cause security issues.

2. Step 2: Identify correct sanitization method

   Removing or escaping HTML tags prevents code injection attacks.

3. Final Answer:

   Use a function that strips or escapes HTML tags -> Option A

4. Quick Check:

   Sanitization = Remove harmful parts [OK]

Hint: Sanitize by removing or escaping harmful code [OK]

Common Mistakes:

• Thinking uppercase conversion sanitizes input
• Ignoring the need to remove HTML tags
• Assuming storing input as is is safe

3. Consider this code snippet in a web application:

user_input = ""
safe_input = sanitize(user_input)
print(safe_input)

If sanitize removes all HTML tags, what will be printed?

medium

A. <script>alert('hack')</script>

B.

C. alert('hack')

D. None

Solution

1. Step 1: Understand the input and sanitization

   The input contains HTML script tags which are harmful. The sanitize function removes all HTML tags.

2. Step 2: Determine the output after sanitization

   Removing tags leaves only the text inside: alert('hack').

3. Final Answer:

   alert('hack') -> Option C

4. Quick Check:

   Sanitize removes tags, output = inner text [OK]

Hint: Sanitize removes tags, leaving inner text only [OK]

Common Mistakes:

• Thinking tags remain after sanitization
• Confusing escaped tags with removed tags
• Assuming output is None or empty

4. A developer wrote this code to validate an email input:

def validate_email(email):
    return '@' in email and '.' in email

What is the main problem with this validation?

medium

A. It does not check the position of '@' and '.' properly

B. It encrypts the email instead of validating

C. It removes special characters from the email

D. It always returns False

Solution

1. Step 1: Analyze the validation logic

   The function only checks if '@' and '.' exist anywhere in the string, without checking order or position.

2. Step 2: Identify why this is a problem

   Emails require '@' before '.', and proper format. This simple check allows invalid emails like 'test.@com'.

3. Final Answer:

   It does not check the position of '@' and '.' properly -> Option A

4. Quick Check:

   Validation must check format, not just presence [OK]

Hint: Check positions, not just presence of characters [OK]

Common Mistakes:

• Thinking it encrypts or removes characters
• Assuming it always fails
• Ignoring format rules in validation

5. You receive user input for a username that must be alphanumeric and between 5 to 10 characters. Which approach best combines validation and sanitization?

hard

A. Encrypt input before validating

B. Only remove spaces without checking length or characters

C. Accept input as is and store it directly

D. Check length and characters, then remove spaces and special symbols

Solution

1. Step 1: Understand requirements for username

   The username must be only letters and numbers, and length between 5 and 10 characters.

2. Step 2: Combine validation and sanitization

   Validation checks length and allowed characters; sanitization removes unwanted spaces or symbols.

3. Final Answer:

   Check length and characters, then remove spaces and special symbols -> Option D

4. Quick Check:

   Validate rules + sanitize unwanted parts = safe input [OK]

Hint: Validate rules first, then clean input [OK]

Common Mistakes:

• Skipping validation and sanitization
• Only sanitizing without validation
• Encrypting before checking input