From the course: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

Unlock this course with a free trial

Join today to access over 23,200 courses taught by industry experts.

Input validation

Input validation

From the course: ISC2 Certified Information Systems Security Professional (CISSP) (2024) Cert Prep

Start my 1-month free trial Buy for my team

Input validation

“

- [Narrator] Any case where users supply input to an application opens that application up to exploitation. User supplied input may contain code designed to interact with a database, manipulate the browsers of future visitors to the site, or perform any of a number of other attacks Elsewhere in this course series. You learned about some of those attacks, including SQL injection and cross site scripting. One of the most important ways that we can protect against input base attacks is the use of input validation. This technique filters user input, making sure that the input provided by end users doesn't contain malicious or otherwise unexpected values. There are two different approaches that we can take to input validation, whitelisting and blacklisting. Whitelisting is the most powerful approach to input validation. In this approach, the developer specifies the exact type of input that is allowed from the end user, and any input not matching that specification is rejected. For example,…

Contents