Improper Input Validation
CWE-20: Improper Input Validation
Improper input validation is the broad weakness of accepting input without checking that it has the properties the code relies on, such as type, length, range, format, or consistency with other fields. It is a parent of many more specific weaknesses, and MITRE encourages mapping vulnerabilities to the more precise child CWE when one applies. On exams it represents the principle that all input is untrusted until validated on the server, with allow-listing preferred over block-listing.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- A shopping cart accepts a negative quantity, producing a refund instead of a charge.
- An API accepts a date of birth in the future or a percentage of 5000 and stores it, breaking downstream calculations.
- Validation is done only in browser JavaScript, so a proxy such as Burp Suite sends values the server never checks.
How to mitigate it
- Validate all input on the server, regardless of client-side checks, as close to the point of entry as possible.
- Use allow-lists that define exactly what is acceptable (type, length, range, format) rather than block-lists of known bad values.
- Validate with schemas (for example JSON Schema or typed request models) so rules are consistent and testable.
- Treat validation as one layer only; still encode output and use parameterized interfaces for each interpreter.
Go deeper
Practice this topic
Test your knowledge of Improper Input Validation with exam-style practice questions.