Improper input validation explained

Improper input validation^[1] or unchecked user input is a type of vulnerability in computer software that may be used for security exploits.^[2] This vulnerability is caused when "[t]he product does not validate or incorrectly validates input that can affect the control flow or data flow of a program."

Examples include:

• Buffer overflow
• Cross-site scripting
• Directory traversal
• Null byte injection
• SQL injection
• Uncontrolled format string

Notes and References

1. Web site: . . CWE-20: Improper Input Validation . December 13, 2010 . February 22, 2011.
2. Book: Erickson, Jon. Hacking: the art of exploitation. No Starch Press Series. Safari Books Online. 2, illustrated. 2008. 978-1-59327-144-2.