Input validation

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which best describes input validation?

A Checking user data is the expected type, length and format before using it

B Locking the data with a key so nobody can read it

2. A form asks for age. A user types "abc". What should a validated program do?

A Reject it and ask for a number

B Accept it and use it in the calculation

3. Which check is a LENGTH check?

A if username.isdigit():

B if len(username) <= 20:

4. Which check is a TYPE check?

A if len(age) < 4:

B if age.isdigit():

5. Why is input validation a defence against SQL injection?

A It rejects harmful input like ' OR 1=1 -- before it reaches the database

B It makes the database faster so attacks cannot finish

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1if not age.isdigit():		ARaw user input is put straight into the SQL query without validation, so harmful input like ' OR '1'='1 can change the query
2if len(username) > 20:		BChecks the length of the input and rejects a username that is too long
3Validate the format of input by only accepting a postcode made of exactly 4 digits		Cif len(code) == 4 and code.isdigit():
4Protect against harmful input by refusing text that contains characters used in injection attacks		Dif "'" in text or "<" in text:
5age = input("Age: ") print("Next year: ", age + 1)		EThe input was used straight away without checking that it is a number, so a letter or text will crash the program
6query = "SELECT * FROM users WHERE name='" + name + "'"		FChecks that the age typed in is made only of digits and rejects it if it is not a whole number

Definitions

input validation

Fill in the Blanks

Complete each line of code by filling in the missing parts.

if age._______(): age = int(age)

if ___(password) >= 8: print("Accepted")

if 0 <= age __ 120: print("Valid age")

_____ not age.isdigit(): age = input("Age: ")

if "'" __ text: print("Rejected")

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A age = input("Enter age: ")

B if age.isdigit():

C print("Invalid age")

D else:

E print("Invalid age")

Question 2

A name = input("Name: ")

B if len(name) >= 20:

C print("Hello", name)

D else:

E print("Too long")

Question 3

A code = int(input("Code: "))

B if code.isdigit():

C print("Accepted")

D else:

E print("Digits only")

Question 4

A n = input("Score 0-100: ")

B while not n.isdigit():

C print("Digits only: ")

D print("Score:", n)

Question 5

A name = input("Name: ")

B if ";" not in name:

C print("Rejected")

D else:

E print("Hello", name)

Answer Key

Input validation

Section A: Quick Questions

A — Checking user data is the expected type, length and format before using it

A — Reject it and ask for a number

B — if len(username) <= 20:

B — if age.isdigit():

A — It rejects harmful input like ' OR 1=1 -- before it reaches the database

Section B: Match the Pairs

if not age.isdigit(): → Checks that the age typed in is made only of digits and rejects it if it is not a whole number

if len(username) > 20: → Checks the length of the input and rejects a username that is too long

Validate the format of input by only accepting a postcode made of exactly 4 digits → if len(code) == 4 and code.isdigit():

Protect against harmful input by refusing text that contains characters used in injection attacks → if "'" in text or "<" in text:

age = input("Age: ") print("Next year: ", age + 1) → The input was used straight away without checking that it is a number, so a letter or text will crash the program

query = "SELECT * FROM users WHERE name='" + name + "'" → Raw user input is put straight into the SQL query without validation, so harmful input like ' OR '1'='1 can change the query

Section C: Definitions

input validation — Checking that data a user enters is the expected type, length and format before the program uses it, so bad or harmful input is rejected.

Section D: Fill in the Blanks

if age.isdigit():
    age = int(age)

if len(password) >= 8:
    print("Accepted")

if 0 <= age <= 120:
    print("Valid age")

while not age.isdigit():
    age = input("Age: ")

if "'" in text:
    print("Rejected")

Section E: Spot the Error

C — This line runs when the input passes the isdigit() check, so it is valid. The message should say the age is valid, for example print("Valid age").

B — A length check should accept names up to the limit. With >= it only accepts long names and rejects short ones. It should be <= 20.

A — Calling int() on the raw input crashes the program if the user types letters, before any validation happens. Keep the input as a string with input() and check it first.

C — The loop must ask the user again and store the new answer in n. Using print() does not collect new input, so the loop never ends. It should be n = input("Digits only: ").

B — Harmful input such as a semicolon used in an injection attack should be rejected. With not in, safe names are rejected and harmful ones are accepted. It should be if ";" in name:.