Input validation and sanitization in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is input validation?

Input validation is the process of checking if the data entered by a user meets the expected format, type, and rules before it is processed.

beginner

What does input sanitization mean?

Input sanitization means cleaning or modifying user input to remove or neutralize harmful parts, like special characters that could cause security problems.

intermediate

Why is input validation important in cybersecurity?

It helps prevent attacks like SQL injection or cross-site scripting by ensuring only safe and expected data is accepted.

beginner

Give an example of input sanitization.

Removing HTML tags from user comments to prevent scripts from running on a website.

intermediate

What is the difference between input validation and input sanitization?

Validation checks if input is correct and allowed; sanitization cleans input to make it safe. Both work together to protect systems.

What is the main goal of input validation?

A To delete all user input

B To store data without checking

C To speed up data processing

D To check if input data is in the correct format

Input validation ensures data is in the expected format before processing.

Which of the following is an example of input sanitization?

A Removing script tags from a text input

B Ignoring user input

C Allowing any characters in a username

D Checking if a phone number has 10 digits

Removing script tags cleans input to prevent harmful code execution.

Why is input sanitization important?

A To prevent security attacks like cross-site scripting

B To make input look nicer

C To increase server speed

D To allow all inputs without checks

Sanitization removes dangerous parts of input to protect against attacks.

Which attack can input validation help prevent?

A Phishing emails

B SQL injection

C Denial of service

D Password guessing

Validating input can block malicious SQL commands from being executed.

What should you do if user input fails validation?

A Accept it anyway

B Ignore the input

C Reject it and ask for correct input

D Store it without changes

Rejecting invalid input helps keep data safe and consistent.

Explain in your own words what input validation and input sanitization are and why they are important.

Think about how checking and cleaning user data helps keep systems safe.

Describe a real-life example where input validation and sanitization can protect a website.

Imagine a comment box on a blog or social media site.

Practice

1. What is the main purpose of input validation in cybersecurity?

easy

A. To delete all user input after use

B. To check if the data meets expected rules before processing

C. To encrypt data before storing it

D. To backup data regularly

Solution

1. Step 1: Understand input validation

   Input validation means checking if the data entered follows the expected format or rules.

2. Step 2: Identify the purpose in cybersecurity

   This helps prevent harmful or incorrect data from causing problems in the system.

3. Final Answer:

   To check if the data meets expected rules before processing -> Option B

4. Quick Check:

   Input validation = Check data rules [OK]

Hint: Validation means checking data correctness before use [OK]

Common Mistakes:

• Confusing validation with encryption
• Thinking validation deletes data
• Assuming validation backs up data

2. Which of the following is the correct way to sanitize a string input to remove HTML tags?

easy

A. Use a function that strips or escapes HTML tags

B. Convert the string to uppercase

C. Add spaces between characters

D. Store the string as is without changes

Solution

1. Step 1: Understand sanitization

   Sanitization means cleaning input to remove harmful parts like HTML tags that can cause security issues.

2. Step 2: Identify correct sanitization method

   Removing or escaping HTML tags prevents code injection attacks.

3. Final Answer:

   Use a function that strips or escapes HTML tags -> Option A

4. Quick Check:

   Sanitization = Remove harmful parts [OK]

Hint: Sanitize by removing or escaping harmful code [OK]

Common Mistakes:

• Thinking uppercase conversion sanitizes input
• Ignoring the need to remove HTML tags
• Assuming storing input as is is safe

3. Consider this code snippet in a web application:

user_input = ""
safe_input = sanitize(user_input)
print(safe_input)

If sanitize removes all HTML tags, what will be printed?

medium

A. <script>alert('hack')</script>

B.

C. alert('hack')

D. None

Solution

1. Step 1: Understand the input and sanitization

   The input contains HTML script tags which are harmful. The sanitize function removes all HTML tags.

2. Step 2: Determine the output after sanitization

   Removing tags leaves only the text inside: alert('hack').

3. Final Answer:

   alert('hack') -> Option C

4. Quick Check:

   Sanitize removes tags, output = inner text [OK]

Hint: Sanitize removes tags, leaving inner text only [OK]

Common Mistakes:

• Thinking tags remain after sanitization
• Confusing escaped tags with removed tags
• Assuming output is None or empty

4. A developer wrote this code to validate an email input:

def validate_email(email):
    return '@' in email and '.' in email

What is the main problem with this validation?

medium

A. It does not check the position of '@' and '.' properly

B. It encrypts the email instead of validating

C. It removes special characters from the email

D. It always returns False

Solution

1. Step 1: Analyze the validation logic

   The function only checks if '@' and '.' exist anywhere in the string, without checking order or position.

2. Step 2: Identify why this is a problem

   Emails require '@' before '.', and proper format. This simple check allows invalid emails like 'test.@com'.

3. Final Answer:

   It does not check the position of '@' and '.' properly -> Option A

4. Quick Check:

   Validation must check format, not just presence [OK]

Hint: Check positions, not just presence of characters [OK]

Common Mistakes:

• Thinking it encrypts or removes characters
• Assuming it always fails
• Ignoring format rules in validation

5. You receive user input for a username that must be alphanumeric and between 5 to 10 characters. Which approach best combines validation and sanitization?

hard

A. Encrypt input before validating

B. Only remove spaces without checking length or characters

C. Accept input as is and store it directly

D. Check length and characters, then remove spaces and special symbols

Solution

1. Step 1: Understand requirements for username

   The username must be only letters and numbers, and length between 5 and 10 characters.

2. Step 2: Combine validation and sanitization

   Validation checks length and allowed characters; sanitization removes unwanted spaces or symbols.

3. Final Answer:

   Check length and characters, then remove spaces and special symbols -> Option D

4. Quick Check:

   Validate rules + sanitize unwanted parts = safe input [OK]

Hint: Validate rules first, then clean input [OK]

Common Mistakes:

• Skipping validation and sanitization
• Only sanitizing without validation
• Encrypting before checking input