Multiple choice technology programming languages

Failure to validate user input is one of the most common sources of software security vulnerabilities. When is it safe to accept user input without validation?

  1. When the application is running behind a firewall

  2. Never; any program that accepts input can be exploited

  3. When the application is written in Perl using the language's "taint mode"

  4. When the user is your own mother
Reveal answer Fill a bubble to check yourself
B Correct answer
Explanation

Input validation is essential regardless of environment. Firewalls don't prevent application-level exploits, taint mode can be bypassed, and trusting any input source creates vulnerabilities. 'Never' is the only safe answer - any unvalidated input is a potential attack vector.

AI explanation

Any input source an attacker can influence — form fields, headers, cookies, URLs, even files — can be crafted to exploit the application, so validation must always happen regardless of firewalls, network position, or perceived trust of the source. A firewall filters network traffic, not the content of application-level requests, so it offers no protection against malicious input. "Taint mode" in Perl helps track unvalidated data but doesn't itself make skipping validation safe. Trust in the person submitting data is irrelevant since the request could be forged, replayed, or the account compromised.

Keep practicing — related questions