OWASP
believes the most common type of security weaknesses comes from failing to
validate client input. This failure causes XSS issues, SQL Injection,
interpreter injection, locale/Unicode attacks, file system attacks, and buffer
overflows. In fact, Michael Howard - the
author of Writing Secure Code - once stated that "all input is
evil". Usually, the larger an
application becomes, the harder it becomes to enforce validation.
I
decided to do some further research on data validation and ended up reading a
small article from Smashing
Magazine. This article talks about
validating user submitted web data to make sure it is the correct format.
Basically, Data can be either validated on the client or on the server and
there pros and cons for both.
Applications validating data on the server-side uses a strong
server-side language instead of a client language like JavaScript. So, even if the client has disabled
JavaScript on their browser, the data will still be validated. The disadvantage
of server side validation is that it takes longer and if there are too many
validations being conducted - it might bring your server to a crawl. Client-side validation should be done if you
want a "more responsive [and] visually rich validation". Basically, the validation can take place
before the form is even submitted and thus users get immediate feedback on
whether the data is valid or not. The
main disadvantage is that since we're using JavaScript - a client can easily
disable it and no validation will take place which means there will be
incorrect data in the database.
