Which technique helps prevent injection attacks by ensuring inputs are safe and well-formed before processing?

• A. Input Validation
• B. Whitelist validation
• C. Data Encoding
• D. Blacklist validation

Answer: (A)

Input validation prevents injection attacks by ensuring inputs are safe and well-formed before the program processes them. By checking type, length, format, and allowed characters, the application rejects anything that doesn’t conform, so untrusted data can’t be used to alter commands, queries, or code paths.

Within input validation, whitelisting—only permitting known-good values or patterns—is the strongest approach because it defines exact acceptable inputs rather than trying to block what’s bad. Data encoding helps in contexts where data will be rendered or embedded, but encoding alone doesn’t guarantee safe processing if validation isn’t done first. Blacklist validation relies on blocking known bad inputs and often misses new or crafted payloads, making it less robust than whitelisting.

For example, accepting a numeric identifier only when it’s digits within a valid range ensures the input cannot be misinterpreted as part of a command or query.