← ACARA Digital Technologies Years 9–10

Input validation

Checking that data a user enters is the expected type, length and format before the program uses it, so bad or harmful input is rejected.

Part of: ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 56, WA Computer Science ATAR Year 11 — Cyber Security — Module 50

Understanding Input validation in ACARA Digital Technologies Years 9–10

What it does: This combines a length check and a type check so only the expected format is accepted, which is input validation. Checking for risky characters such as quotes and angle brackets rejects harmful input before the program uses it, which helps stop SQL injection and XSS. Age should be a number, so text fails the type check and must be rejected. len() measures how many characters were entered. isdigit() checks the type of characters instead. Allowing only known good input (an allow list) is safer because attackers can disguise bad input. The first has symbols and script tags, so it fails the format check and could be harmful. The second matches the format.

Common mistakes: This line runs when the input passes the isdigit() check, so it is valid. The message should say the age is valid, for example print("Valid age"). A length check should accept names up to the limit. With >= it only accepts long names and rejects short ones. It should be <= 20.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Input validation to a class →

This module's key terms are also in a printable crossword (Modules 782–809) and word search (Modules 743–809).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which best describes input validation?
Locking the data with a key so nobody can read itChecking user data is the expected type, length and format before using it
Matches
age = input("Age: ") print("Next year: ", age + 1)
↓
The input was used straight away without checking that it is a number, so a letter or text will crash the program
Applying
Meanings
Term
input validation
Meaning
Checking that data a user enters is the expected type, length and format before the program uses it, so bad or harmful input is rejected.
Practice
def valid_username(name):
Testing
Gaps
if age.():
Check Answer
Spots
2if age.isdigit():
3 print("Invalid age")

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Narwhal' badge — Unicorn Coder, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which best describes input validation?
A. Checking user data is the expected type, length and format before using it ✓
B. Locking the data with a key so nobody can read it
Input validation checks what a user enters before the program uses it. Encryption is a different protection.
2. A form asks for age. A user types "abc". What should a validated program do?
A. Reject it and ask for a number ✓
B. Accept it and use it in the calculation
Age should be a number, so text fails the type check and must be rejected.
3. Which check is a LENGTH check?
A. if username.isdigit():
B. if len(username) <= 20: ✓
len() measures how many characters were entered. isdigit() checks the type of characters instead.
4. Which check is a TYPE check?
A. if len(age) < 4:
B. if age.isdigit(): ✓
isdigit() tests that the input is made of digits, which is a type check. len() is a length check.
5. Why is input validation a defence against SQL injection?
A. It rejects harmful input like ' OR 1=1 -- before it reaches the database ✓
B. It makes the database faster so attacks cannot finish
Attackers type code into input boxes. Validation blocks input that does not match the expected format.

Match the Pairs

if not age.isdigit(): → Checks that the age typed in is made only of digits and rejects it if it is not a whole number
if len(username) > 20: → Checks the length of the input and rejects a username that is too long
Validate the format of input by only accepting a postcode made of exactly 4 digits → if len(code) == 4 and code.isdigit():
Protect against harmful input by refusing text that contains characters used in injection attacks → if "'" in text or "<" in text:
age = input("Age: ") print("Next year: ", age + 1) → The input was used straight away without checking that it is a number, so a letter or text will crash the program
query = "SELECT * FROM users WHERE name='" + name + "'" → Raw user input is put straight into the SQL query without validation, so harmful input like ' OR '1'='1 can change the query

Key Term

input validation
Checking that data a user enters is the expected type, length and format before the program uses it, so bad or harmful input is rejected.

Fill in the Blanks

1. if age.isdigit(): age = int(age)
Hint: Type the string method that checks every character is a digit, so the input is the expected type.
2. if len(password) >= 8: print("Accepted")
Hint: Type the built-in function that counts how many characters are in the text, to check its length.
3. if 0 <= age <= 120: print("Valid age")
Hint: Type the comparison operator that keeps the age at or below the upper limit of the allowed range.
4. while not age.isdigit(): age = input("Age: ")
Hint: Type the keyword that keeps repeating the question until the user enters valid data.
5. if "'" in text: print("Rejected")
Hint: Type the keyword that tests whether a harmful character appears inside the text, so the input can be rejected.

Spot the Error

Question 1
A age = input("Enter age: ")
B if age.isdigit():
C print("Invalid age")
D else:
E print("Invalid age")
Line C — This line runs when the input passes the isdigit() check, so it is valid. The message should say the age is valid, for example print("Valid age").
Question 2
A name = input("Name: ")
B if len(name) >= 20:
C print("Hello", name)
D else:
E print("Too long")
Line B — A length check should accept names up to the limit. With >= it only accepts long names and rejects short ones. It should be <= 20.
Question 3
A code = int(input("Code: "))
B if code.isdigit():
C print("Accepted")
D else:
E print("Digits only")
Line A — Calling int() on the raw input crashes the program if the user types letters, before any validation happens. Keep the input as a string with input() and check it first.
Question 4
A n = input("Score 0-100: ")
B while not n.isdigit():
C print("Digits only: ")
D print("Score:", n)
Line C — The loop must ask the user again and store the new answer in n. Using print() does not collect new input, so the loop never ends. It should be n = input("Digits only: ").
Question 5
A name = input("Name: ")
B if ";" not in name:
C print("Rejected")
D else:
E print("Hello", name)
Line B — Harmful input such as a semicolon used in an injection attack should be rejected. With not in, safe names are rejected and harmful ones are accepted. It should be if ";" in name:.

Student with a class code? Join your class →