What is Input Validation?
Input Validation checks data from AI, human users, APIs, files, and connected services before an application accepts, stores, or acts on it. It is applied at a trust boundary, where a system cannot assume data structure, origin, or intent. MITRE CWE-20 identifies improper input validation as a weakness that can lead to unexpected or unsafe behavior. Validation defines permitted type, length, range, format, encoding, and business rules. It is distinct from authentication, authorization, output encoding, and sanitization.
What is Input Validation used for?
Teams use Input Validation to reject, normalize, or safely handle nonconforming data before it reaches parsers, databases, business logic, or downstream services. Server-side rules are the security control; client-side checks improve usability. Effective implementation tests malformed and boundary-case inputs, records useful signals without exposing sensitive data, and connects data-flow assumptions to concrete control points.
