Input validation
Name:
Date:
Class:
A
Quick Questions
Shade in the A or B circle for each question.
1. A sign-up form asks for age. Which is an example of input validation?
2. A username box should hold 3 to 20 characters. What should validation do with a 500-character username?
3. A phone number field should only contain digits. Which input should be rejected?
4. Which check tests the type of the data?
5. A web form checks input in the browser using JavaScript. Is that enough on its own?
B
Match the Pairs
Draw a line connecting each item on the left to its match on the right.
| Left column | Right column | |
|---|---|---|
| 1if len(username) > 20: | AChecks that the input contains only digits, so it is the expected type | |
| 2age.isdigit() | BThe server does no validation and trusts the browser check, which an attacker can bypass | |
| 3Reject unexpected characters by allowing only letters and numbers | Cif not name.isalnum(): reject() | |
| 4Validate on the server as well as in the browser, because browser checks can be bypassed | DChecks the length of the input and rejects it if it is too long | |
| 5query = "SELECT * FROM users WHERE name='" + name + "'" | EThe input is used straight away without being validated, so a user could type harmful characters that change the query | |
| 6// Browser only: if (age < 0) stop(); // Server: save(age) | Fdef save(form): if not valid(form): return error() |
C
Definitions
input validation
D
Fill in the Blanks
Complete each line of code by filling in the missing parts.
1.
<input type="text" _________="20">
2.
if not age._______():
print("Numbers only")
3.
if "<" __ comment:
print("Not allowed")
4.
if len(name) _ 20:
print("Too long")
5.
# Server: check again
if ___ name.isalpha():
return "Rejected"
E
Spot the Error
Shade in the letter of the line that contains an error.
Question 1
A
name = input("Name: ")
B
max_len = 20
C
if len(name) >= max_len:
D
print("Welcome", name)
E
else:
F
print("Too long")
Question 2
A
age = input("Age: ")
B
if age.isalpha():
C
print("Valid age")
D
else:
E
print("Enter digits only")
Question 3
A
user = input("Username: ")
B
# letters and numbers only
C
if user.isalnum:
D
print("OK")
E
else:
F
print("Rejected")
Question 4
A
def check_code(code)
B
if len(code) != 4:
C
return False
D
return code.isdigit()
Question 5
A
qty = input("Qty: ")
B
if not qty.isdigit():
C
print("Numbers only")
D
pass
E
total = int(qty) * 5
Answer Key
Input validation
Section A: Quick Questions
Q1
A — Checking the age is a whole number between 0 and 120 before saving it
Q2
B — Reject it because it is longer than the allowed length
Q3
B — 04<script>12
Q4
A — Confirming that a quantity box contains a number, not words
Q5
A — No, the server must validate the input too
Section B: Match the Pairs
Q1
if len(username) > 20: → Checks the length of the input and rejects it if it is too long
Q2
age.isdigit() → Checks that the input contains only digits, so it is the expected type
Q3
Reject unexpected characters by allowing only letters and numbers → if not name.isalnum(): reject()
Q4
Validate on the server as well as in the browser, because browser checks can be bypassed → def save(form):
if not valid(form): return error()
Q5
query = "SELECT * FROM users WHERE name='" + name + "'" → The input is used straight away without being validated, so a user could type harmful characters that change the query
Q6
// Browser only: if (age < 0) stop();
// Server: save(age) → The server does no validation and trusts the browser check, which an attacker can bypass
Section C: Definitions
Q1
input validation — Checking that data a user enters is the expected type, length and format before the program uses it, so bad or harmful input is rejected.Section D: Fill in the Blanks
Q1
<input type="text" maxlength="20">Q2
if not age.isdigit():
print("Numbers only")Q3
if "<" in comment:
print("Not allowed")Q4
if len(name) > 20:
print("Too long")Q5
# Server: check again
if not name.isalpha():
return "Rejected"Section E: Spot the Error
Q1
C — The length check is backwards. >= accepts only names that are too long and rejects normal ones. It should be len(name) <= max_len.
Q2
B — isalpha() checks for letters, but an age should be made of digits. It should be age.isdigit() so that the type check accepts numbers.
Q3
C — The brackets are missing, so the method is never called. A method name on its own is always truthy, so every input is accepted. It should be user.isalnum().
Q4
A — A function definition must end with a colon. The line should be def check_code(code): so the validation function can run.
Q5
D — pass does nothing, so the program carries on with invalid input and int(qty) crashes. Invalid input must be rejected by stopping, for example with exit().