[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 5 · 5.5.b
AP Cybersecurity · Securing Applications and Data
How Input Sanitization Protects Applications
Applications encase input in control characters — sanitization stops the user supplying their own.
key ideaApplications encase input in control characters to process it. Sanitization stops the user supplying their own.
The syntax
When users enter input, the application typically encases that input in special characters to process it — those are control characters. An adversary who can include control characters in their input escapes the container and is no longer supplying data.
what an unsanitized field receivesthe input contains the characters the application uses structurally
input received: ' OR 1=1 --
# the application encases user input in control characters to process it.
# the quote closes the intended string early; the rest becomes command.
the quotea control character the application uses to encase the valueclosing earlythe input ends the container the application built around itwhat followsis read as part of the surrounding instruction, not as datathe root causethe application never checked what characters the input contained
| What the check asks | What it prevents |
|---|
| does the input meet the expected criteria? | values that were never valid for this field |
| does it contain control characters? | input escaping the container the application built around it |
| is it within the expected length? | buffer overflow where a fixed-size region is written |
| does it match the expected pattern? | unexpected structure reaching a query, a page or a path |
The CED's requirement is one sentence: programmers should use a function to verify that user input meets their expected criteria and does not include any control characters. Every row above is that sentence applied.
Doing it step by step
1
Define what valid input looks like
Type, length, format, allowed characters. You cannot check against criteria you have not stated — and a field with no definition is a field with no check.
in an input field out expected criteria
2
Write one function, and call it everywhere
The CED says use a function — singular. Per-field ad-hoc checks drift, and the field somebody forgot is the one that gets used.
out a single validation routine
3
Reject or escape control characters
These are the characters the application uses structurally. Either refuse input containing them, or escape them so they are treated as literal text.
out input that cannot change the structure
4
Validate on the server, not only in the browser
Client-side checks improve the user experience and can be bypassed entirely. The authoritative check runs where the data is processed.
out a check an adversary cannot skip
5
Test with hostile input
Quotes, angle brackets, path separators, over-length strings. A validation function nobody attacked is a validation function nobody has tested.
out evidence it holds
the shape of the validation functioncriteria, control characters, and a single call site
function validate(input):
if length(input) > MAX: reject
if input contains CONTROL_CHARS: reject or escape
if not matches(EXPECTED_PATTERN): reject
return sanitized(input)
# every input field calls this before the value goes anywhere.length checkanswers buffer overflowCONTROL_CHARSanswers injection and cross-site scriptingEXPECTED_PATTERNthe expected criteria the CED requires you to verify againstone functioncalled by every field — not reimplemented per formreject or escapeeither is valid; silently accepting is not
Worked analysis
EX 1
Why control characters are special
Explain why an application treats certain characters differently from the rest of a user's input.
1
State what the application does with input
It encases that input in special characters in order to process it.
2
Name those characters
Control characters — they carry structural meaning, not content.
3
State what happens if the user supplies one
The container closes early, and what follows is read as instruction.
4
Connect to the attacks
This is the mechanism behind SQL injection and cross-site scripting alike.
5
Give the defense
Verify that user input does not include control characters before it goes anywhere.
EX 2
Reject or escape?
A comment field must accept apostrophes, which are also control characters in the query. What do you do?
1
Reject the simple ban
Refusing apostrophes breaks legitimate input — names and ordinary English contain them.
2
State the alternative
Escape them, so the application treats them as literal text rather than structure.
3
Note that both satisfy the requirement
The check must ensure input does not include control characters that could be executed — escaping achieves that.
4
Choose by field
Reject where the character is never valid; escape where it legitimately occurs.
5
State the invariant
Whatever the user typed must end up as data, never as structure.
EX 3
The field nobody validated
An application validates every form field except a hidden one used for a tracking value. Why is that enough to be exploited?
1
Note the assumption
A hidden field is assumed to be under the application’s control.
2
State why that fails
Anything sent to the server is user input, whatever the form intended.
3
State the consequence
That one field reaches an interpreter unvalidated.
4
Apply the CED requirement
The check applies to user input — and everything arriving from a client is user input.
5
State the design rule
One function, called at every entry point — which is exactly why the CED describes a function rather than a habit.
Verify the result
four checks
- Every input field — including hidden ones — passes through the validation function.
- The function checks expected criteria and control characters, as the CED requires.
- Validation runs server-side; client-side checks are convenience, not control.
- Test with quotes, angle brackets, path separators and over-length input before believing it works.
Check yourself
What are control characters, in this context?
Show answer
The special characters an application uses to encase user input so that it can process it. They carry structural meaning rather than content.
What does the CED require of programmers taking user input?
Show answer
They should use a function to verify that user input meets their expected criteria and does not include any control characters that could be executed.
Why is a client-side check insufficient?
Show answer
It can be bypassed entirely — anything sent to the server is user input regardless of what the browser was told to send. The authoritative check must run where the data is processed.
Which attacks does input sanitization address?
Show answer
SQL injection and cross-site scripting through control characters, buffer overflow through length, and directory traversal through path structure — all four share the same root cause.