How should input validation be handled to prevent common security issues, and what categories exist?

• A. Validate only on the client side.
• B. Validation is optional for performance.
• C. Use a single global validator on page load.
• D. Validate at all layers, server-side, with type/format checks, range constraints, and sanitation; defense-in-depth.

Answer: (D)

Input validation should be implemented across multiple layers, with a strong emphasis on server-side checks. Client-side validation alone cannot be trusted because end users can bypass it, tamper data, or use malformed inputs. A defense-in-depth approach means validating data at all entry points and layers of the system so that even if one layer is bypassed, others still block bad input.

The best practice is to validate input with concrete categories: ensure the data has the expected type and format (for example, a number where a number is required, or an email that matches a valid pattern); enforce range or length constraints so values stay within acceptable bounds; and apply sanitation or normalization to remove or neutralize dangerous content before it is used in queries or rendered, reducing risks like SQL injection or XSS. Together, these checks help maintain data integrity and security as data flows from input to processing to storage and output.