Possible and Sensible

Ensures that it is possible for the program to do something with the data, and that it makes sense to accept this data from an input source.

• Presence (e.g. a user email is required for sign up)
• Range (e.g. age restrictions, bank balances)
• Length (e.g. entering passwords)
• Format (e.g. date formats)
• Data Type (e.g. types of characters in passwords, age as integers) 

What does validation not ensure?

Examples

• Web applications are highly vulnerable to input validation errors.

  • “!@#$%^&*()” on a vulnerable e-commerce site may cause performance issues, or “denial of service”, on a vulnerable system,

  • Invalid passwords such as “pwd’” or “1=1— ” may result in unauthorised access.

• A Norwegian woman mistyped her account number on an internet banking system. Instead of typing her 11-digit account number, she accidentally typed an extra digit, for a total of 12 numbers. The system discarded the extra digit, and transferred $100,000 to the (incorrect) account. A simple instruction informing her that she had typed too many digits would have helped avoid this expensive error.

  • Olsen, Kai. “The $100,000 Keying error” IEEE Computer, August 2008

• ​More: http://cis1.towson.edu/~cssecinj/modules/cs0/cs0-input-validation-python/

https://bootsnipp.com/snippets/67OaM