Input Validation and Output Encoding
Validate all inputs on the server side, encode outputs in the correct context, and prevent injection.
Input Validation and Output Encoding is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Input Validation Matters
Injection vulnerabilities — SQL, command, LDAP, XPath, and more — arise when untrusted input is interpreted as code. Input validation ensures data conforms to expected types, lengths, and formats before it is processed, stored, or returned.
Allowlist vs Denylist Validation
Allowlist (whitelist) validation defines what IS acceptable: only alphanumeric characters, only integers in range 1-100, only valid email formats. Denylist (blacklist) tries to block known bad inputs and is always incomplete. Prefer allowlists.
Validation on the Server Side
Client-side validation improves UX but provides zero security — attackers bypass it trivially using browser devtools or curl. Always validate on the server side. Client-side is a courtesy; server-side is the security control.
Input Validation for Different Data Types
Numbers: check type and range. Strings: check length and character set. Dates: parse strictly, check range. Files: check extension AND magic bytes/MIME type — never trust extension alone. URLs: parse and validate scheme, host, and path components.
Parameterized Queries Prevent SQLi
The most important output of input validation for databases is to never concatenate user input into SQL. Use parameterized queries (prepared statements) where user input is passed as a parameter, not interpolated into the query string.
// WRONG:
const q = "SELECT * FROM users WHERE name = '" + name + "'";
// RIGHT:
const q = "SELECT * FROM users WHERE name = $1";
await client.query(q, [name]);Output Encoding Contexts
The same string requires different encoding depending on context. HTML body: HTML-encode (< > &). HTML attribute: HTML-attribute encoding. JavaScript: JS-escape. URL parameter: URL-encode (percent-encoding). Using wrong encoding leaves gaps attackers exploit.
HTML Encoding Against XSS
Never insert user data directly into HTML. Use a templating engine or library that auto-escapes HTML. In React, {value} is safe; dangerouslySetInnerHTML bypasses escaping. In Django, templates auto-escape unless you use safe filter explicitly.
JavaScript Context Encoding
When inserting data into JavaScript (e.g., a variable initialized with user data), HTML-encoding is insufficient. Use JSON encoding: JSON.stringify(value). This prevents data from breaking out of a JS string literal context.
URL Encoding
User-supplied data inserted into URLs must be percent-encoded using encodeURIComponent() (JS) or urllib.parse.quote() (Python). Unencoded data can manipulate URL structure, leading to open redirects or path traversal.
Content Security Policy as Defense-in-Depth
CSP adds a second line of defense against XSS. A strict CSP using nonces prevents inline script execution even if an XSS payload is injected, because the browser refuses to execute scripts without the correct nonce attribute.
DOM-Based XSS Prevention
DOM XSS occurs when JavaScript reads from attacker-controlled sources (location.hash, document.URL, cookie) and writes to dangerous sinks (innerHTML, document.write, eval). Audit all data flows from browser APIs to DOM sinks using static analysis tools.
Knowledge Check
Why is server-side input validation essential even when client-side validation is implemented?
Summary
Input validation (allowlists, type checking, length limits) combined with context-sensitive output encoding (HTML, JS, URL, SQL parameterization) are the primary defenses against injection and XSS attacks. Both must be applied server-side without exception.
Frequently asked questions
Is the “Input Validation and Output Encoding” lesson free?
Yes — the full text of “Input Validation and Output Encoding” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Input Validation and Output Encoding”?
Validate all inputs on the server side, encode outputs in the correct context, and prevent injection. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Input Validation and Output Encoding” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Input Validation and Output Encoding
- Secure Dependency Management
- OWASP ASVS: Application Security Verification Standard
- Secure Code Review Techniques