Data Validation Testing

OWASP believes the most common type of security weaknesses comes from failing to validate client input. This failure causes XSS issues, SQL Injection, interpreter injection, locale/Unicode attacks, file system attacks, and buffer overflows.  In fact, Michael Howard - the author of Writing Secure Code - once stated that "all input is evil".  Usually, the larger an application becomes, the harder it becomes to enforce validation.

I decided to do some further research on data validation and ended up reading a small article from Smashing Magazine.  This article talks about validating user submitted web data to make sure it is the correct format. Basically, Data can be either validated on the client or on the server and there pros and cons for both.  Applications validating data on the server-side uses a strong server-side language instead of a client language like JavaScript.  So, even if the client has disabled JavaScript on their browser, the data will still be validated. The disadvantage of server side validation is that it takes longer and if there are too many validations being conducted - it might bring your server to a crawl.  Client-side validation should be done if you want a "more responsive [and] visually rich validation".  Basically, the validation can take place before the form is even submitted and thus users get immediate feedback on whether the data is valid or not.  The main disadvantage is that since we're using JavaScript - a client can easily disable it and no validation will take place which means there will be incorrect data in the database.