CyberCertPrepSecurity FundamentalsWeb Security BasicsEASYFree question
What is input validation in web security?
- A.Encrypting input data
- B.Checking if the user is logged in, because command injection is stopped by escaping output rather than input
- C.Logging all user inputs
- D.Verifying that user-supplied data meets expected format, type, length, and range before processing
Why D is correct
Input validation checks that data conforms to expectations: correct data type, within length limits, matches expected patterns (regex for email, phone), within valid ranges, and doesn't contain dangerous characters. Validation should be server-side (client-side can be bypassed). It's a defense-in-depth measure, not a sole defense against injection.
Know someone studying for Security Fundamentals? Send them this one.