Input Validation
What is Input Validation?
The process of verifying that user-supplied data meets expected formats and constraints before processing, preventing injection attacks and data corruption.
Terms that appear alongside input validation
Each of these is named in at least one of the same controls as input validation. The number is how many controls name both.
- owasp 5 shared controls
- authentication 4 shared controls
- api security 3 shared controls
- secure coding 3 shared controls
- gateway 2 shared controls
- security testing 2 shared controls
- application security 2 shared controls
- session management 2 shared controls
Frameworks that govern input validation
What the standards actually require on input validation
Requirements naming input validation across 6 standards, quoted from the control text.
All input validation rules are documented, matched in code and tested with both positive and negative unit testing or integration testing.
ISM-2057 · All input validation rules are documented, matched in code and tested with both positive a →Rank 12 in the 2024 CWE Top 25 (frequency x severity of CVEs). The product does not validate, or incorrectly validates, input that affects the control flow or data flow of the program.
CWE-20 · Improper Input Validation →Requires the validity of organization-defined information inputs to be checked, so that data entering the system is verified for syntax, type and value before it is processed.
NIST800-SI-10 · Information input validation →Address API7:2023 Server Side Request Forgery (SSRF) + input validation per OWASP API Security Top 10 2023 + OWASP-API-PRG-05 Input and Output Validation.
OWASPAPI-5 · Server Side Request Forgery (SSRF) and Input Validation →Per OWASP ASVS V13: secure APIs + web services. Requirements include (a) implement authentication + authorisation consistently across all API endpoints + (b) implement input validation + output encoding + against OWASP API Security Top 10 + (c) maintain API do...
OWASPASVS-13 · API and Web Service Security (V13) →Apply the Application Security and Development STIG and application-server STIGs, covering secure development, input validation, authentication and session management, and application logging.
STIG-SRG-APP · Application and application server STIG →Questions people ask about input validation
What is Input Validation?
Why is Input Validation important for compliance?
Which compliance frameworks address Input Validation?
Where can I learn more about Input Validation?
See how Input Validation applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.