Input Validation is one of the most important security practices in modern applications. Every input coming from users, browsers, mobile apps, or third-party systems should be considered untrusted until it is validated.

Poor input validation can lead to SQL Injection, XSS, Command Injection, Buffer Overflow, and many other security vulnerabilities.

---

Q1. What is Input Validation?

Answer

Input Validation is the process of verifying that user-provided data meets predefined rules before it is processed by the application.

Validation ensures that incoming data is:

• Correct
• Complete
• Safe
• Expected

Example

Valid Age

25

Invalid Age

Twenty Five

Only valid input should be accepted.

---

Q2. Why is Input Validation important?

Answer

Without proper validation, attackers can inject malicious input into an application.

Common risks include:

• SQL Injection
• Cross-Site Scripting (XSS)
• Command Injection
• LDAP Injection
• XML Injection
• Buffer Overflow
• Business Logic Abuse

Production Example

Login API

POST /login

If the username field accepts any value without validation, an attacker could attempt SQL Injection.

Proper validation significantly reduces this risk.

---

Q3. What are the different types of Input Validation?

Answer

There are two primary types:

Client-Side Validation

Performed in the browser using JavaScript.

Advantages:

• Better user experience
• Immediate feedback

Disadvantage:

• Can be bypassed easily

Server-Side Validation

Performed on the backend.

Advantages:

• Mandatory
• Cannot be bypassed by disabling JavaScript

Interview Tip

Always perform server-side validation, even if client-side validation exists.

---

Q4. What is Allowlist (Whitelist) validation?

Answer

Allowlist validation accepts only expected values.

Example

Allowed characters:

A-Z
a-z
0-9

Everything else is rejected.

Example

Username

Valid

john123

Invalid

john<script>

Allowlist validation is considered the safest approach.

---

Q5. What is Denylist (Blacklist) validation?

Answer

Denylist validation blocks known malicious inputs.

Example:

Reject

<script>

Reject

DROP TABLE

Problem

Attackers constantly create new attack patterns.

Therefore, denylist validation alone is not sufficient.

Best Practice

Prefer Allowlist validation over Denylist validation.

---

Q6. How do you implement Input Validation in Spring Boot?

Answer

Spring Boot provides Bean Validation using Jakarta Validation.

Example

public class UserRequest {

    @NotBlank
    private String name;

    @Email
    private String email;

    @Min(18)
    private Integer age;
}

Controller

@PostMapping("/users")
public ResponseEntity<?> createUser(
        @Valid @RequestBody UserRequest request) {

    return ResponseEntity.ok("Success");
}

If validation fails, Spring Boot automatically returns a 400 Bad Request response.

---

Q7. What validations are commonly used in enterprise applications?

Answer

Typical validations include:

• Required fields
• Email format
• Phone number format
• Password strength
• Maximum length
• Minimum length
• Numeric range
• Date validation
• Enum validation
• File size validation
• File type validation

Example

Password Policy

• Minimum 8 characters
• One uppercase letter
• One lowercase letter
• One number
• One special character

---

Q8. How does Input Validation prevent SQL Injection?

Answer

Input Validation reduces the risk of malicious input reaching the database.

Example

Malicious Input

' OR 1=1 --

Proper validation rejects unexpected characters.

However, validation alone is not enough.

Always combine it with:

• Prepared Statements
• Parameterized Queries
• ORM Frameworks (JPA/Hibernate)

Interview Tip

Parameterized queries are the primary defense against SQL Injection.

---

Q9. What are common Input Validation mistakes?

Answer

Common mistakes include:

• Validating only on the client
• Trusting frontend applications
• Accepting unlimited input length
• Using only blacklist validation
• Returning detailed validation errors
• Ignoring file upload validation
• Not sanitizing HTML input
• Not validating request parameters

Production Example

Never trust:

• Mobile Apps
• Browsers
• Third-party APIs

Always validate input on the server.

---

Q10. What are the Input Validation best practices?

Answer

Follow these best practices:

• Validate every input
• Validate on the server
• Use allowlist validation
• Reject unexpected data
• Limit input size
• Validate uploaded files
• Use Bean Validation annotations
• Use parameterized SQL queries
• Sanitize HTML when required
• Log validation failures for monitoring

Production Architecture

              Client
                 │
          Input Validation
                 │
         Spring Validation
                 │
      Business Validation
                 │
        Authorization Check
                 │
        Business Services
                 │
            Database

Senior Interview Tip

Input Validation should be implemented in multiple layers:

• Browser Validation (User Experience)
• API Validation
• Business Validation
• Database Constraints

Never rely on a single validation layer.

---

Quick Revision

• Validate every user input.
• Never trust client-side validation.
• Use allowlist validation whenever possible.
• Prefer Bean Validation in Spring Boot.
• Use @Valid with DTOs.
• Combine validation with parameterized SQL queries.
• Limit input length.
• Validate uploaded files.
• Sanitize HTML input.
• Implement validation at multiple layers.