Validation & Sanitisation
Computer Science: OCR GCSE, topic 2.3.2
Validation and Sanitisation
Validation and sanitisation can help to protect against malicious inputs such as SQL injection attacks.
Input sanitisation
- Input sanitisation involves the removal of unwanted characters from input data.
- This is a chief line of defence against attacks such as the SQL injection attack.
- Any data entered by users which might be executed or become part of a query should first be sanitised.
- For example: if a user types a space before typing something to input and the space is not removed, this causes issues as the input will not match EXACTLY when compared.
Input validation
- Input validation is the process of making sure that input data meets certain criteria.
- If a user's data is rejected, they should be informed and asked to enter it again.
- Examples:
- An error message when you forget to fill a mandatory field in an online form.
- Asking users to enter a password twice to prevent mistyping.
- Dropdown boxes to ensure the selected value falls within a specific range.
Input validation rules
- Type checks check the type (e.g. Integer) of the input.
- Range checks check that the data is inside an allowed range, e.g. less than 100.
- Presence checks check that the required data has been input.
- Format checks check that the data fits a set format, e.g. an email address has an @ symbol.
- Length checks check that the number of characters entered is inside a permitted range.
Test yourself on Validation & Sanitisation
What is validation?