Input validation and sanitization in Cybersecurity - Step-by-Step Execution

Concept Flow - Input validation and sanitization

User Input Received

↓

Validate Input Format?

No→Reject Input

Yes↓

Sanitize Input Content

↓

Safe Input Passed to System

↓

Process Input Safely

Input is first checked for correct format, then cleaned to remove harmful parts before use.

Execution Sample

Cybersecurity

input_value = get_user_input()
if not is_valid(input_value):
    reject()
else:
    safe_input = sanitize(input_value)
    process(safe_input)

This code checks if input is valid, rejects if not, otherwise cleans it before processing.

Analysis Table

Step	Action	Input Value	Validation Result	Sanitized Output	Next Step
1	Receive input	'<script>'	Not checked yet	Not sanitized yet	Validate input format
2	Validate input	'<script>'	Invalid (contains tags)	N/A	Reject input
3	Reject input	'<script>'	Invalid	N/A	Stop processing
4	Receive input	'hello123'	Not checked yet	Not sanitized yet	Validate input format
5	Validate input	'hello123'	Valid (alphanumeric)	N/A	Sanitize input
6	Sanitize input	'hello123'	Valid	'hello123'	Process input
7	Process input	'hello123'	Valid	'hello123'	Complete

💡 Input rejected if invalid; otherwise sanitized and processed safely.

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6	Final
input	None	'<script>'	'<script>'	'<script>'	'hello123'	'hello123'	'hello123'	'hello123'
validation_result	None	None	Invalid	Invalid	None	Valid	Valid	Valid
sanitized_output	None	None	None	None	None	None	'hello123'	'hello123'
processing_state	None	None	Rejected	Rejected	None	None	Processed	Processed

Key Insights - 3 Insights

Why do we reject input immediately after validation fails?

Because invalid input can cause errors or security risks, rejecting early prevents unsafe data from entering the system, as shown in step 3 of the execution_table.

What does sanitization do if input is valid?

Sanitization cleans the input by removing or encoding harmful parts, making it safe to use, as seen in step 6 where '<script>' is rejected but 'hello123' passes unchanged.

Can sanitization fix invalid input?

No, sanitization only cleans valid input; invalid input is rejected before sanitization, as shown by the immediate rejection of '<script>' in step 3.

Visual Quiz - 3 Questions

Look at the execution_table, what is the validation result at step 5?

A Not checked yet

B Invalid (contains tags)

C Valid (alphanumeric)

D Rejected

💡 Hint

Check the 'Validation Result' column in row for step 5.

At which step does the system reject the input '<script>'?

A Step 3

B Step 5

C Step 2

D Step 6

💡 Hint

Look at the 'Next Step' and 'Action' columns for when rejection happens.

If the input was 'hello<script>', what would likely change in the execution_table?

A Input would be accepted without sanitization

B Validation would fail and input would be rejected early

C Sanitization would be skipped

D Processing would happen without validation

💡 Hint

Refer to how invalid inputs like '