Two Validation Approaches

A large part of security is based upon validation: if data comes from outside of the server—from HTML forms, the URL, cookies, it can’t be trusted. (A higher level of security also validates any data coming from outside of the script, including sessions and databases.) There are two types of validation: whitelist and blacklist. In the calculator example, we know that all values must be positive, that they must all be numbers, and that the quantity must be an integer (the other two numbers could be integers or floats, it makes no difference). Typecasting forces the inputs to be numbers, and a check confirms that they are positive. At this point, the assumption is that the input is valid. This is a whitelist approach: these values are good; anything else is bad.

The preventing spam example uses a blacklist approach. That script knows exactly which characters are bad and invalidates input that contains them. All other input is considered to be good.

Many security experts prefer the whitelist approach, but it can’t always be used. Each example will dictate which approach will work best, but it’s important to use one or the other. Don’t just assume that data is safe without some sort of validation.