Application security
Every input is a hypothesis until the server confirms otherwise.
Server-side validation, parameterized queries, context-aware encoding and explicit rules that keep untrusted data under control.
Validation happens on the server
Browser validation improves the experience, but it can be changed or bypassed. The server applies the rules again, checking type, format, size, range and the relationship with the current operation state.
When there is a finite set of values, an allowlist is clearer than trying to recognize everything dangerous. Free-form text requires its own handling and should not be damaged merely for containing legitimate characters.
Data must not become instructions
Parameterized queries keep the operation structure separate from received values. The same principle applies to commands, paths, headers and integrations.
Known routes and files can be resolved through explicit maps. This prevents external input from directly deciding what the system executes or includes.
Output and rules depend on context
A value that is safe as HTML text may be unsafe inside JavaScript, CSS, a URL or an attribute. Encoding must understand the interpreter that will receive the data.
A well-formed request can still be unauthorized. Who may perform an action, in which sequence and on which record are authorization and workflow rules that also belong to security.