Security
Beginner
What is Input Validation?
The process of verifying that user-supplied data meets expected formats, types, and ranges before processing it.
Input validation is the first line of defense against injection attacks, data corruption, and application errors. Validation should happen on both client-side (for user experience) and server-side (for security — client-side validation can be bypassed). Approaches include allowlisting (accepting only known-good patterns), denylisting (rejecting known-bad patterns — less secure), type checking, length limits, range validation, and format validation (regex for emails, dates). In PHP, filter_var() and filter_input() provide built-in validation. Never trust user input — validate everything from form fields to HTTP headers, cookies, file uploads, and API parameters. Validation failures should return clear error messages without revealing system internals.
