Trusting nothing.
WHERE INPUT COMES FROM
Forms URLs and query strings Headers and cookies Uploaded files APIs Anything in your database that was once input
WHAT TO VALIDATE
That it is present where required That it is the expected type That it is within acceptable length and range That it matches the expected format
WHERE TO VALIDATE
On the server, always.
Browser validation is convenience only.
WHAT TO DO WITH INVALID INPUT
Reject it with a clear message, preserving what was entered.
WHAT NOT TO DO
Attempt to clean it and proceed Assume a hidden field was not altered
THAT SECOND POINT
Hidden fields, disabled fields and values in the page are all under the visitor's control.
WHAT TO NEVER TRUST
The price in a hidden field An identifier indicating whose record to modify
THAT LAST ONE
Always check that the signed-in user is entitled to the record they named.
WHAT THAT PREVENTS
Access to other people's data by changing a number.
