As a starting point for the discussion of input validation, I will base the discussion on OWASP
secure coding guidelines.
First of all, it is necessary to understand what the possible input channels are for a Web application
in this slide, I highlighted the various possibilities with which a Web application can receive data
inputs, because it is important that validation takes place on all possible input channels.
The validation must include a phase of canonicalization of the data before validating them or returning
data to a standard format to avoid validation by-pass with transcoding techniques. The validation must
verify that the input data respect the expected format in terms of size, data type, range.
For the search for input characters that underlie particular types of attack, it is always better
to reason from a white list of allowed characters rather than a blacklist of illegal characters.
Also prefer the mechanism of regular expressions for the validation of input. In addition, to validating
the input of Web applications
It is also important to make sure that the output of the application does not cause damage to third
parties, such as the database with which the server side application dialogues or web clients through
responses.
The lack of adequate input validation is the cause of a huge variety of possible types of attacks,
of which the slide provides a list.
Thank you for your kind attention.