Input Validation, Output Encoding and Parameterized Queries
- It is the right type of data? — Date/string/integer/float/etc.
- It is within the appropriate range for size? Is it too long? Too short? Does that day actually exist? (June 31st is not a real day)
- Is the data is appropriate? — If you are expecting a username, why does it contain characters other than a-z, A-Z, 0–9? If the field is for the date of a future event, why is the date entered in the past? Business logic should be applied here.
- Is the data is in the correct format? — If it’s a call to an API, is the call following the protocol of requested input? Is the XML in the correct format? Is it MM/DD/YY, DD/MM/YY or YYYY/DD/MM?