Input Validation & Sanitization

Every vulnerability in this subject has the same root cause: user input being trusted and used somewhere it shouldn't be. Validation rejects input that doesn't match what's expected (an email field that isn't shaped like an email, a quantity field that isn't a positive number). Sanitization goes further — it doesn't just check the input, it transforms it into a safe form (like the HTML-escaping from the XSS article).

The practical rule: validate and sanitize on the server, not just in the browser. Client-side validation is a good user-experience nicety, since it gives instant feedback, but it's trivial for an attacker to bypass entirely by sending a request directly to the server, skipping the browser and its JavaScript altogether.