🛡 Defensive Data Input Handling

📚 Syllabus Dot Point

Design, develop and implement code using defensive data input handling practices, including input validation, sanitisation and error handling

Every time your application accepts input from a user — a login form, a search bar, a comment box, a file upload — that input is a potential attack vector. An attacker does not need to find a backdoor if you leave the front door wide open by trusting whatever the user types.

Defensive data input handling is the practice of treating ALL user input as potentially dangerous until proven otherwise. It is built on one golden rule:

⚠️ The Golden Rule of Input Handling

NEVER trust user input. ALWAYS validate, sanitise, and handle errors.

It does not matter if the input comes from a login form, an API request, a URL parameter, a cookie, a file upload, or even another system. If the data originated outside your trusted code, it must be checked before it is used.

This lesson covers three defensive practices that work together like layers of protection:

Input validation checks whether the data meets your expected format BEFORE you process it. Like a bouncer at a club checking IDs — if you do not meet the criteria, you do not get in.

Sanitisation cleans the data by removing or escaping dangerous characters. Like washing vegetables before cooking — even if they look fine, you wash them to remove anything harmful you cannot see.

Error handling ensures that when something goes wrong, the application fails safely without revealing sensitive information. Like a circuit breaker in your house — when there is a power surge, it trips and cuts the power rather than letting the wires catch fire.