Never Trust Input: Validation
The golden rule of application security: all input is untrusted. Form fields, URLs, headers, uploaded files and API payloads can all be crafted by an attacker. Validation checks that input is what you expect before you use it.
Prefer an allow list (accept only known good patterns) to a block list (try to list everything bad, which always misses something). Check type, length, range and format, and reject anything else. Validate on the server: browser checks are a convenience, and attackers skip the browser.
Which approach to validation is safer?
Write valid_code(text) that accepts exactly 3 capital letters followed by 3 digits (like ABC123). Print results for ABC123, abc123 and ABCD12, one per line.
Finish the quick check (and any code exercise) to complete this lesson, or mark it done yourself.
Tip: use the left and right arrow keys to move between lessons.