← Years 9–10 Digital Systems

Input validation

Checking that data a user enters is the expected type, length and format before the program uses it, so bad or harmful input is rejected.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 40, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 45

Understanding Input validation in Years 9–10 Digital Systems

What it does: Allowing only expected characters blocks symbols such as quotes and semicolons that are often used in attacks like SQL injection. The server cannot trust data from the browser. An attacker can skip the page and send data directly, so the server must check it again. Input validation checks the type and range of data before the program uses it. Rejecting unexpected characters like < and > helps stop harmful code being sent through a form. Browser checks improve the user experience, but server-side validation provides the real protection.

Common mistakes: The length check is backwards. >= accepts only names that are too long and rejects normal ones. It should be len(name) <= max_len. isalpha() checks for letters, but an age should be made of digits. It should be age.isdigit() so that the type check accepts numbers.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Input validation to a class →

This module's key terms are also in a printable crossword (Modules 25–40) and word search (Modules 13–40).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A sign-up form asks for age. Which is an example of input validation?
Saving whatever the user typed in the age box without checkingChecking the age is a whole number between 0 and 120 before saving it
Matches
query = "SELECT * FROM users WHERE name='" + name + "'"
↓
The input is used straight away without being validated, so a user could type harmful characters that change the query
Applying
Meanings
Term
input validation
Meaning
Checking that data a user enters is the expected type, length and format before the program uses it, so bad or harmful input is rejected.
Practice
// Validate on the server as well as the browser
Testing
Gaps
<input type="text" ="20">
Check Answer
Spots
2max_len = 20
3if len(name) >= max_len:

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Narwhal' badge — Unicorn Coder, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A sign-up form asks for age. Which is an example of input validation?
A. Checking the age is a whole number between 0 and 120 before saving it ✓
B. Saving whatever the user typed in the age box without checking
Input validation checks the type and range of data before the program uses it.
2. A username box should hold 3 to 20 characters. What should validation do with a 500-character username?
A. Accept it because the user typed it on purpose
B. Reject it because it is longer than the allowed length ✓
Checking length stops unexpectedly long input, which can cause errors or be used in attacks like a buffer overflow.
3. A phone number field should only contain digits. Which input should be rejected?
A. 0412345678
B. 04<script>12 ✓
Rejecting unexpected characters like < and > helps stop harmful code being sent through a form.
4. Which check tests the type of the data?
A. Confirming that a quantity box contains a number, not words ✓
B. Confirming that the page loads quickly
Type checking makes sure the data is the kind the program expects, such as a number instead of text.
5. A web form checks input in the browser using JavaScript. Is that enough on its own?
A. No, the server must validate the input too ✓
B. Yes, browser checks cannot be bypassed
Attackers can turn off or skip browser checks and send data straight to the server, so the server must always validate.

Match the Pairs

if len(username) > 20: → Checks the length of the input and rejects it if it is too long
age.isdigit() → Checks that the input contains only digits, so it is the expected type
Reject unexpected characters by allowing only letters and numbers → if not name.isalnum(): reject()
Validate on the server as well as in the browser, because browser checks can be bypassed → def save(form): if not valid(form): return error()
query = "SELECT * FROM users WHERE name='" + name + "'" → The input is used straight away without being validated, so a user could type harmful characters that change the query
// Browser only: if (age < 0) stop(); // Server: save(age) → The server does no validation and trusts the browser check, which an attacker can bypass

Key Term

input validation
Checking that data a user enters is the expected type, length and format before the program uses it, so bad or harmful input is rejected.

Fill in the Blanks

1. <input type="text" maxlength="20">
Hint: Type the HTML attribute that limits how many characters can be entered in the box.
2. if not age.isdigit(): print("Numbers only")
Hint: Type the string method that checks every character is a digit, so the type is as expected.
3. if "<" in comment: print("Not allowed")
Hint: Type the keyword that checks whether an unexpected character appears inside the text.
4. if len(name) > 20: print("Too long")
Hint: Type the comparison operator that tests whether the length is over the limit.
5. # Server: check again if not name.isalpha(): return "Rejected"
Hint: Type the keyword that reverses the check so invalid input is rejected on the server.

Spot the Error

Question 1
A name = input("Name: ")
B max_len = 20
C if len(name) >= max_len:
D print("Welcome", name)
E else:
F print("Too long")
Line C — The length check is backwards. >= accepts only names that are too long and rejects normal ones. It should be len(name) <= max_len.
Question 2
A age = input("Age: ")
B if age.isalpha():
C print("Valid age")
D else:
E print("Enter digits only")
Line B — isalpha() checks for letters, but an age should be made of digits. It should be age.isdigit() so that the type check accepts numbers.
Question 3
A user = input("Username: ")
B # letters and numbers only
C if user.isalnum:
D print("OK")
E else:
F print("Rejected")
Line C — The brackets are missing, so the method is never called. A method name on its own is always truthy, so every input is accepted. It should be user.isalnum().
Question 4
A def check_code(code)
B if len(code) != 4:
C return False
D return code.isdigit()
Line A — A function definition must end with a colon. The line should be def check_code(code): so the validation function can run.
Question 5
A qty = input("Qty: ")
B if not qty.isdigit():
C print("Numbers only")
D pass
E total = int(qty) * 5
Line D — pass does nothing, so the program carries on with invalid input and int(qty) crashes. Invalid input must be rejected by stopping, for example with exit().

Student with a class code? Join your class →