Input validation and sanitization in Cybersecurity - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the sentence to explain input validation.

Cybersecurity

Input validation is the process of checking if user input [1] the expected format.

Drag options to blanks, or click blank then click option'

Ahides

Bignores

Cmatches

Ddeletes

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing words like 'ignores' or 'deletes' which do not describe validation.

Input validation ensures the data entered by users matches the expected format to prevent errors or attacks.

2fill in blank

medium

Complete the sentence to explain input sanitization.

Cybersecurity

Input sanitization means removing or encoding [1] characters from user input to prevent security issues.

Drag options to blanks, or click blank then click option'

Adangerous

Bsafe

Cempty

Dfriendly

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing safe characters with dangerous ones.

Sanitization removes or changes dangerous characters that could harm the system or cause attacks.

3fill in blank

hard

Fix the error in the sentence about input validation.

Cybersecurity

Input validation should be done only [1] the data is stored in the database.

Drag options to blanks, or click blank then click option'

Awithout

Bafter

Cwhile

Dbefore

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing 'after' which allows bad data to be stored.

Input validation must happen before storing data to ensure only correct and safe data is saved.

4fill in blank

hard

Fill both blanks to complete the sentence about sanitization methods.

Cybersecurity

Sanitization can be done by [1] dangerous characters or [2] them to safe forms.

Drag options to blanks, or click blank then click option'

Aremoving

Bignoring

Cencoding

Dduplicating

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing 'ignoring' or 'duplicating' which do not protect against attacks.

Sanitization involves removing harmful characters or encoding them so they cannot cause harm.

5fill in blank

hard

Fill all three blanks to complete the dictionary comprehension about input validation.

Cybersecurity

valid_inputs = {input: input[1] for input in inputs if len(input) [2] 0 and input.isalnum() [3] True}

Drag options to blanks, or click blank then click option'

A.lower()

B>

C==

D.strip()

Attempts:

3 left

💡 Hint

Common Mistakes

Using '.lower()' instead of '.strip()' which does not remove spaces.

Using '==' instead of '>' for length check.

This code strips whitespace, checks input length is greater than zero, and confirms input is alphanumeric.

Practice

1. What is the main purpose of input validation in cybersecurity?

easy

A. To delete all user input after use

B. To check if the data meets expected rules before processing

C. To encrypt data before storing it

D. To backup data regularly

Solution

1. Step 1: Understand input validation

   Input validation means checking if the data entered follows the expected format or rules.

2. Step 2: Identify the purpose in cybersecurity

   This helps prevent harmful or incorrect data from causing problems in the system.

3. Final Answer:

   To check if the data meets expected rules before processing -> Option B

4. Quick Check:

   Input validation = Check data rules [OK]

Hint: Validation means checking data correctness before use [OK]

Common Mistakes:

• Confusing validation with encryption
• Thinking validation deletes data
• Assuming validation backs up data

2. Which of the following is the correct way to sanitize a string input to remove HTML tags?

easy

A. Use a function that strips or escapes HTML tags

B. Convert the string to uppercase

C. Add spaces between characters

D. Store the string as is without changes

Solution

1. Step 1: Understand sanitization

   Sanitization means cleaning input to remove harmful parts like HTML tags that can cause security issues.

2. Step 2: Identify correct sanitization method

   Removing or escaping HTML tags prevents code injection attacks.

3. Final Answer:

   Use a function that strips or escapes HTML tags -> Option A

4. Quick Check:

   Sanitization = Remove harmful parts [OK]

Hint: Sanitize by removing or escaping harmful code [OK]

Common Mistakes:

• Thinking uppercase conversion sanitizes input
• Ignoring the need to remove HTML tags
• Assuming storing input as is is safe

3. Consider this code snippet in a web application:

user_input = ""
safe_input = sanitize(user_input)
print(safe_input)

If sanitize removes all HTML tags, what will be printed?

medium

A. <script>alert('hack')</script>

B.

C. alert('hack')

D. None

Solution

1. Step 1: Understand the input and sanitization

   The input contains HTML script tags which are harmful. The sanitize function removes all HTML tags.

2. Step 2: Determine the output after sanitization

   Removing tags leaves only the text inside: alert('hack').

3. Final Answer:

   alert('hack') -> Option C

4. Quick Check:

   Sanitize removes tags, output = inner text [OK]

Hint: Sanitize removes tags, leaving inner text only [OK]

Common Mistakes:

• Thinking tags remain after sanitization
• Confusing escaped tags with removed tags
• Assuming output is None or empty

4. A developer wrote this code to validate an email input:

def validate_email(email):
    return '@' in email and '.' in email

What is the main problem with this validation?

medium

A. It does not check the position of '@' and '.' properly

B. It encrypts the email instead of validating

C. It removes special characters from the email

D. It always returns False

Solution

1. Step 1: Analyze the validation logic

   The function only checks if '@' and '.' exist anywhere in the string, without checking order or position.

2. Step 2: Identify why this is a problem

   Emails require '@' before '.', and proper format. This simple check allows invalid emails like 'test.@com'.

3. Final Answer:

   It does not check the position of '@' and '.' properly -> Option A

4. Quick Check:

   Validation must check format, not just presence [OK]

Hint: Check positions, not just presence of characters [OK]

Common Mistakes:

• Thinking it encrypts or removes characters
• Assuming it always fails
• Ignoring format rules in validation

5. You receive user input for a username that must be alphanumeric and between 5 to 10 characters. Which approach best combines validation and sanitization?

hard

A. Encrypt input before validating

B. Only remove spaces without checking length or characters

C. Accept input as is and store it directly

D. Check length and characters, then remove spaces and special symbols

Solution

1. Step 1: Understand requirements for username

   The username must be only letters and numbers, and length between 5 and 10 characters.

2. Step 2: Combine validation and sanitization

   Validation checks length and allowed characters; sanitization removes unwanted spaces or symbols.

3. Final Answer:

   Check length and characters, then remove spaces and special symbols -> Option D

4. Quick Check:

   Validate rules + sanitize unwanted parts = safe input [OK]

Hint: Validate rules first, then clean input [OK]

Common Mistakes:

• Skipping validation and sanitization
• Only sanitizing without validation
• Encrypting before checking input