Which practice is essential for preventing common web application attacks like SQL Injection and XSS by validating input and using whitelists?

Which practice is essential for preventing common web application attacks like SQL Injection and XSS by validating input and using whitelists?

• A. Output encoding.
• B. Federated identity management.
• C. Input validation.
• D. Camouflage.

Answer: (C)

Validating input against a whitelist is essential because it enforces strict data formats and blocks unexpected, potentially harmful content before it reaches the application logic. When you define exactly what is allowed and reject anything that doesn’t match, you prevent attackers from injecting SQL fragments or scripts through user input. For SQL Injection, data that fits the expected types and ranges can be safely used with parameterized queries, which further prevents malicious input from altering the database command. For XSS, keeping input within safe patterns reduces the chance that injected scripts will be stored and later executed in a browser, especially when combined with proper escaping when rendering data. Output encoding matters too for XSS, since escaping characters when displaying data provides a safety net, but it doesn’t address validating and filtering the data at entry—precisely what whitelisting does. Federated identity management deals with authentication across domains, not input validation. Camouflage isn’t a recognized security practice.

Validating input against a whitelist is essential because it enforces strict data formats and blocks unexpected, potentially harmful content before it reaches the application logic. When you define exactly what is allowed and reject anything that doesn’t match, you prevent attackers from injecting SQL fragments or scripts through user input. For SQL Injection, data that fits the expected types and ranges can be safely used with parameterized queries, which further prevents malicious input from altering the database command. For XSS, keeping input within safe patterns reduces the chance that injected scripts will be stored and later executed in a browser, especially when combined with proper escaping when rendering data.

Output encoding matters too for XSS, since escaping characters when displaying data provides a safety net, but it doesn’t address validating and filtering the data at entry—precisely what whitelisting does. Federated identity management deals with authentication across domains, not input validation. Camouflage isn’t a recognized security practice.