Input Validation and Sanitization

Input Validation and Sanitization – Building Robust Defense Mechanisms Against Malicious Data

Imagine building a fortress where every entrance is carefully guarded, every visitor is thoroughly checked, and any suspicious items are either cleaned or rejected before entry. This is exactly what input validation and sanitization do for web applications—they serve as the first line of defense against malicious data that could compromise your application's security, integrity, and functionality.

Input validation and sanitization represent the fundamental security practices that protect applications from a wide range of attacks including Cross-Site Scripting (XSS), SQL injection, command injection, and data corruption. Every piece of data that enters your application—whether from user forms, API requests, file uploads, or URL parameters—must be treated as potentially dangerous until proven safe through proper validation and sanitization processes.

In modern web applications where user-generated content flows through multiple layers of processing, validation, and storage, implementing comprehensive input security becomes critical for maintaining application security, data integrity, and user trust. This involves not just checking data format and length, but also understanding context-specific sanitization needs and implementing defense-in-depth strategies.

In this comprehensive guide, we'll explore advanced input validation and sanitization techniques, from client-side validation patterns and server-side security implementations to context-aware sanitization and building bulletproof input security architectures that protect against evolving attack vectors.

Understanding Input Security Architecture

Effective input security requires a multi-layered approach that validates data at multiple points, sanitizes based on usage context, and implements fail-safe mechanisms when validation fails.

The Theoretical Foundation of Input Security

What is Input Validation? Input validation is the process of ensuring that user-provided data meets specific criteria before it's processed by your application. Think of it like a security checkpoint at an airport—every piece of data must pass through multiple security checks before it's allowed to enter your application's core systems.

Why Multi-Layer Validation is Critical:

Client-Side Validation (User Experience Layer):
- Purpose: Provides immediate feedback to users and reduces server load
- Limitation: Can be bypassed by attackers who control the client
- Example: Checking email format before form submission
Server-Side Validation (Security Layer):
- Purpose: Authoritative validation that cannot be bypassed
- Critical Role: Final decision on whether data is acceptable
- Example: Re-validating all form data when it reaches the server
Context-Aware Sanitization (Protection Layer):
- Purpose: Clean data based on how it will be used
- Adaptive: Different sanitization for HTML display vs database storage
- Example: HTML encoding for web display, SQL escaping for database queries

The Attack Surface Problem: Every input field, URL parameter, HTTP header, and file upload represents a potential attack vector. Without proper validation, each becomes a doorway for malicious code injection, data corruption, or system compromise.

Input Security Layers

🛡️ Input Security Defense Layers

🔍 Client-Side Validation (First Line)
   • Format validation and UI feedback
   • Length limits and character restrictions
   • Real-time validation with user guidance
   • Pattern matching and regex validation

⚡ Server-Side Validation (Critical Layer)
   • Authoritative validation and rejection
   • Business rule enforcement
   • Data type and range validation
   • Authentication and authorization checks

🧼 Input Sanitization (Context-Aware)
   • HTML encoding for web display
   • SQL parameter binding for databases
   • Command escaping for system calls
   • File path sanitization for file operations

🔒 Output Encoding (Context-Specific)
   • HTML entity encoding
   • JavaScript string escaping
   • CSS value sanitization
   • URL encoding for redirects

🚨 Security Monitoring
   • Malicious input detection
   • Attack pattern recognition
   • Rate limiting and throttling
   • Security logging and alerting

Advanced Input Validation Implementation

Building comprehensive input validation requires sophisticated techniques that handle various data types, sources, and attack vectors while maintaining application usability and performance.

Enterprise-Grade Input Security System

/**
 * Advanced Input Validation and Sanitization Framework
 * Comprehensive solution for client-side and server-side input security
 */

class InputSecurityFramework {
  constructor(config = {}) {
    this.config = {
      // Validation modes
      strictMode: config.strictMode !== false,
      allowEmptyStrings: config.allowEmptyStrings || false,
      trimInputs: config.trimInputs !== false,
      
      // Security settings
      maxInputLength: config.maxInputLength || 10000,
      maxNestingDepth: config.maxNestingDepth || 10,
      enableSqlInjectionDetection: config.enableSqlInjectionDetection !== false,
      enableXssDetection: config.enableXssDetection !== false,
      enableCommandInjectionDetection: config.enableCommandInjectionDetection !== false,
      
      // Sanitization options
      htmlSanitization: {
        allowedTags: config.htmlSanitization?.allowedTags || ['p', 'br', 'strong', 'em', 'u'],
        allowedAttributes: config.htmlSanitization?.allowedAttributes || ['class', 'id'],
        removeScript: config.htmlSanitization?.removeScript !== false,
        removeStyle: config.htmlSanitization?.removeStyle !== false
      },
      
      // Custom validation rules
      customRules: config.customRules || {},
      
      // Performance settings
      enableCaching: config.enableCaching !== false,
      cacheSize: config.cacheSize || 1000,
      
      ...config
    };

    // Internal state
    this.validationCache = new Map();
    this.securityPatterns = this.initializeSecurityPatterns();
    this.validators = this.initializeValidators();
    this.sanitizers = this.initializeSanitizers();
    
    // Statistics
    this.stats = {
      validationsPerformed: 0,
      validationsFailed: 0,
      securityThreatsDetected: 0,
      sanitizationsPerformed: 0
    };
  }

  // Security Pattern Initialization
  initializeSecurityPatterns() {
    return {
      // XSS Detection Patterns
      xss: [
        /<script[^>]*>.*?<\/script>/gi,
        /javascript:/gi,
        /on\w+\s*=/gi,
        /<iframe[^>]*>/gi,
        /<object[^>]*>/gi,
        /<embed[^>]*>/gi,
        /<link[^>]*>/gi,
        /<meta[^>]*>/gi,
        /expression\s*\(/gi,
        /url\s*\(/gi,
        /@import/gi,
        /vbscript:/gi
      ],
      
      // SQL Injection Patterns
      sqlInjection: [
        /(\bunion\b|\bselect\b|\binsert\b|\bupdate\b|\bdelete\b|\bdrop\b|\bcreate\b|\balter\b)/gi,
        /(\bor\b|\band\b)\s+[\w\s]*\s*[=<>]/gi,
        /['"][\s]*;[\s]*--/gi,
        /\/\*.*?\*\//gi,
        /((\%27)|'|(\%3D)|=)[^\n]*((\%6F)|o|(\%4F))((\%72)|r|(\%52))/gi,
        /exec\s*\(/gi,
        /xp_cmdshell/gi
      ],
      
      // Command Injection Patterns
      commandInjection: [
        /[\|&;`'\"\$\(\)]/g,
        /\.\.[\/\\]/g,
        /(wget|curl|nc|netcat|telnet|ssh|ftp)/gi,
        /(cat|less|more|head|tail)\s+/gi,
        /(rm|del|format|fdisk)\s+/gi,
        /(\n|\r\n|\r)\s*(cd|ls|dir|pwd)/gi
      ],
      
      // Path Traversal Patterns
      pathTraversal: [
        /\.\.[\/\\]/g,
        /%2e%2e[\/\\]/gi,
        /\.%2f/gi,
        /%252f/gi,
        /\.\.\\/g,
        /\.\.%5c/gi
      ],
      
      // LDAP Injection Patterns
      ldapInjection: [
        /[\(\)\|\&\!]/g,
        /\*[^=]*=/g,
        /=[^)]*\)/g
      ]
    };
  }

  // Validator Initialization
  initializeValidators() {
    return {
      // Basic Data Type Validators
      string: (value, options = {}) => {
        if (typeof value !== 'string') return false;
        
        const len = value.length;
        if (options.minLength && len < options.minLength) return false;
        if (options.maxLength && len > options.maxLength) return false;
        
        if (options.pattern && !options.pattern.test(value)) return false;
        if (options.allowedChars && ![...value].every(char => options.allowedChars.includes(char))) return false;
        
        return true;
      },
      
      number: (value, options = {}) => {
        const num = Number(value);
        if (isNaN(num)) return false;
        
        if (options.min !== undefined && num < options.min) return false;
        if (options.max !== undefined && num > options.max) return false;
        if (options.integer && !Number.isInteger(num)) return false;
        
        return true;
      },
      
      boolean: (value) => {
        return typeof value === 'boolean' || value === 'true' || value === 'false';
      },
      
      // Advanced Validators
      email: (value) => {
        const emailPattern = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
        return emailPattern.test(value);
      },
      
      url: (value, options = {}) => {
        try {
          const url = new URL(value);
          if (options.allowedProtocols && !options.allowedProtocols.includes(url.protocol.slice(0, -1))) {
            return false;
          }
          if (options.allowedDomains && !options.allowedDomains.some(domain => url.hostname.endsWith(domain))) {
            return false;
          }
          return true;
        } catch {
          return false;
        }
      },
      
      phone: (value, options = {}) => {
        const phonePattern = options.pattern || /^[\+]?[1-9][\d]{0,15}$/;
        return phonePattern.test(value.replace(/[\s\-\(\)]/g, ''));
      },
      
      creditCard: (value) => {
        // Luhn algorithm
        const digits = value.replace(/\D/g, '');
        let sum = 0;
        let isEvenIndex = false;
        
        for (let i = digits.length - 1; i >= 0; i--) {
          let digit = parseInt(digits.charAt(i), 10);
          
          if (isEvenIndex) {
            digit *= 2;
            if (digit > 9) {
              digit -= 9;
            }
          }
          
          sum += digit;
          isEvenIndex = !isEvenIndex;
        }
        
        return sum % 10 === 0;
      },
      
      ipAddress: (value, options = {}) => {
        const ipv4Pattern = /^(\d{1,3}\.){3}\d{1,3}$/;
        const ipv6Pattern = /^([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$/;
        
        if (options.version === 'v4') return ipv4Pattern.test(value);
        if (options.version === 'v6') return ipv6Pattern.test(value);
        
        return ipv4Pattern.test(value) || ipv6Pattern.test(value);
      },
      
      // File Validators
      filename: (value, options = {}) => {
        const invalidChars = /[<>:"/\\|?*\x00-\x1f]/g;
        if (invalidChars.test(value)) return false;
        
        if (options.allowedExtensions) {
          const ext = value.split('.').pop().toLowerCase();
          return options.allowedExtensions.includes(ext);
        }
        
        return true;
      },
      
      // Security-Specific Validators
      noSqlInjection: (value) => {
        return !this.detectThreat(value, 'sqlInjection');
      },
      
      noXss: (value) => {
        return !this.detectThreat(value, 'xss');
      },
      
      noCommandInjection: (value) => {
        return !this.detectThreat(value, 'commandInjection');
      },
      
      noPathTraversal: (value) => {
        return !this.detectThreat(value, 'pathTraversal');
      }
    };
  }

  // Sanitizer Initialization
  initializeSanitizers() {
    return {
      // HTML Sanitization
      html: (input, options = {}) => {
        let sanitized = input;
        
        // Remove script tags
        if (options.removeScript !== false) {
          sanitized = sanitized.replace(/<script[^>]*>.*?<\/script>/gi, '');
        }
        
        // Remove style tags
        if (options.removeStyle !== false) {
          sanitized = sanitized.replace(/<style[^>]*>.*?<\/style>/gi, '');
        }
        
        // Remove dangerous attributes
        sanitized = sanitized.replace(/on\w+\s*=\s*["'][^"']*["']/gi, '');
        sanitized = sanitized.replace(/javascript:/gi, '');
        sanitized = sanitized.replace(/vbscript:/gi, '');
        
        // Encode HTML entities
        sanitized = sanitized
          .replace(/&/g, '&amp;')
          .replace(/</g, '&lt;')
          .replace(/>/g, '&gt;')
          .replace(/"/g, '&quot;')
          .replace(/'/g, '&#x27;')
          .replace(/\//g, '&#x2F;');
        
        return sanitized;
      },
      
      // SQL Sanitization (Parameter Binding)
      sql: (input, options = {}) => {
        if (typeof input !== 'string') return input;
        
        // Escape single quotes
        return input.replace(/'/g, "''");
      },
      
      // JavaScript String Sanitization
      javascript: (input) => {
        return input
          .replace(/\\/g, '\\\\')
          .replace(/'/g, "\\'")
          .replace(/"/g, '\\"')
          .replace(/\n/g, '\\n')
          .replace(/\r/g, '\\r')
          .replace(/\t/g, '\\t');
      },
      
      // URL Component Sanitization
      url: (input, options = {}) => {
        if (options.component === 'query') {
          return encodeURIComponent(input);
        } else if (options.component === 'path') {
          return encodeURI(input);
        }
        return encodeURI(input);
      },
      
      // File Path Sanitization
      filepath: (input) => {
        return input
          .replace(/\.\.[\/\\]/g, '')
          .replace(/[<>:"|?*\x00-\x1f]/g, '')
          .replace(/^[\/\\]+/, '')
          .replace(/[\/\\]+$/, '');
      },
      
      // Command Line Sanitization
      shell: (input) => {
        // Remove dangerous characters
        return input.replace(/[\|&;`'\"\$\(\)<>]/g, '');
      },
      
      // XML Sanitization
      xml: (input) => {
        return input
          .replace(/&/g, '&amp;')
          .replace(/</g, '&lt;')
          .replace(/>/g, '&gt;')
          .replace(/"/g, '&quot;')
          .replace(/'/g, '&apos;');
      },
      
      // LDAP Sanitization
      ldap: (input) => {
        return input
          .replace(/\\/g, '\\5c')
          .replace(/\*/g, '\\2a')
          .replace(/\(/g, '\\28')
          .replace(/\)/g, '\\29')
          .replace(/\x00/g, '\\00');
      }
    };
  }

  // Threat Detection
  detectThreat(input, threatType) {
    if (!this.securityPatterns[threatType]) {
      return false;
    }
    
    const patterns = this.securityPatterns[threatType];
    return patterns.some(pattern => pattern.test(input));
  }

  // Comprehensive Security Scan
  performSecurityScan(input) {
    const threats = [];
    
    for (const [threatType, patterns] of Object.entries(this.securityPatterns)) {
      if (patterns.some(pattern => pattern.test(input))) {
        threats.push(threatType);
      }
    }
    
    if (threats.length > 0) {
      this.stats.securityThreatsDetected++;
    }
    
    return threats;
  }

  // Main Validation Method
  validate(input, schema, context = {}) {
    try {
      this.stats.validationsPerformed++;
      
      // Check cache first
      const cacheKey = this.generateCacheKey(input, schema);
      if (this.config.enableCaching && this.validationCache.has(cacheKey)) {
        return this.validationCache.get(cacheKey);
      }
      
      const result = this.validateValue(input, schema, context);
      
      // Cache successful validations
      if (this.config.enableCaching && result.isValid) {
        this.addToCache(cacheKey, result);
      }
      
      if (!result.isValid) {
        this.stats.validationsFailed++;
      }
      
      return result;
      
    } catch (error) {
      this.stats.validationsFailed++;
      return {
        isValid: false,
        errors: [`Validation error: ${error.message}`],
        sanitized: input
      };
    }
  }

  validateValue(input, schema, context, path = '') {
    const result = {
      isValid: true,
      errors: [],
      warnings: [],
      sanitized: input,
      threats: []
    };
    
    // Handle null/undefined
    if (input == null) {
      if (schema.required) {
        result.isValid = false;
        result.errors.push(`${path || 'Value'} is required`);
      }
      return result;
    }

    // Pre-processing
    if (this.config.trimInputs && typeof input === 'string') {
      input = input.trim();
      result.sanitized = input;
    }

    // Length validation
    if (typeof input === 'string' && input.length > this.config.maxInputLength) {
      result.isValid = false;
      result.errors.push(`${path || 'Input'} exceeds maximum length of ${this.config.maxInputLength}`);
      return result;
    }

    // Security threat detection
    if (typeof input === 'string') {
      const threats = this.performSecurityScan(input);
      if (threats.length > 0) {
        result.threats = threats;
        if (this.config.strictMode) {
          result.isValid = false;
          result.errors.push(`Security threat detected: ${threats.join(', ')}`);
        } else {
          result.warnings.push(`Potential security threat: ${threats.join(', ')}`);
        }
      }
    }

    // Type validation
    if (schema.type) {
      const validator = this.validators[schema.type];
      if (validator && !validator(input, schema.options)) {
        result.isValid = false;
        result.errors.push(`${path || 'Value'} is not a valid ${schema.type}`);
        return result;
      }
    }

    // Custom validation rules
    if (schema.custom) {
      for (const [ruleName, ruleConfig] of Object.entries(schema.custom)) {
        const customValidator = this.config.customRules[ruleName];
        if (customValidator) {
          const customResult = customValidator(input, ruleConfig);
          if (!customResult.isValid) {
            result.isValid = false;
            result.errors.push(...customResult.errors);
          }
        }
      }
    }

    // Sanitization
    if (schema.sanitize) {
      for (const [sanitizer, options] of Object.entries(schema.sanitize)) {
        const sanitizerFn = this.sanitizers[sanitizer];
        if (sanitizerFn) {
          result.sanitized = sanitizerFn(result.sanitized, options);
          this.stats.sanitizationsPerformed++;
        }
      }
    }

    // Nested object validation
    if (schema.properties && typeof input === 'object') {
      result.sanitized = {};
      for (const [key, subSchema] of Object.entries(schema.properties)) {
        const subResult = this.validateValue(input[key], subSchema, context, `${path}.${key}`);
        if (!subResult.isValid) {
          result.isValid = false;
          result.errors.push(...subResult.errors);
        }
        result.warnings.push(...subResult.warnings);
        result.threats.push(...subResult.threats);
        result.sanitized[key] = subResult.sanitized;
      }
    }

    // Array validation
    if (schema.items && Array.isArray(input)) {
      result.sanitized = [];
      input.forEach((item, index) => {
        const subResult = this.validateValue(item, schema.items, context, `${path}[${index}]`);
        if (!subResult.isValid) {
          result.isValid = false;
          result.errors.push(...subResult.errors);
        }
        result.warnings.push(...subResult.warnings);
        result.threats.push(...subResult.threats);
        result.sanitized.push(subResult.sanitized);
      });
    }

    return result;
  }

  // Sanitization Methods
  sanitize(input, sanitizers, options = {}) {
    let result = input;
    
    for (const sanitizer of sanitizers) {
      const sanitizerFn = this.sanitizers[sanitizer];
      if (sanitizerFn) {
        result = sanitizerFn(result, options[sanitizer]);
        this.stats.sanitizationsPerformed++;
      }
    }
    
    return result;
  }

  // Context-Aware Sanitization
  sanitizeForContext(input, context) {
    switch (context) {
      case 'html':
        return this.sanitizers.html(input);
      case 'html-attribute':
        return this.sanitizers.html(input, { strictAttributeMode: true });
      case 'javascript':
        return this.sanitizers.javascript(input);
      case 'sql':
        return this.sanitizers.sql(input);
      case 'url':
        return this.sanitizers.url(input);
      case 'css':
        return input.replace(/[<>'"]/g, '');
      case 'json':
        return JSON.stringify(input);
      default:
        return this.sanitizers.html(input);
    }
  }

  // Batch Validation
  validateBatch(inputs, schemas) {
    const results = [];
    
    for (let i = 0; i < inputs.length; i++) {
      const input = inputs[i];
      const schema = schemas[i] || schemas[0]; // Use first schema as fallback
      
      results.push(this.validate(input, schema));
    }
    
    return {
      results,
      allValid: results.every(r => r.isValid),
      errors: results.flatMap(r => r.errors),
      warnings: results.flatMap(r => r.warnings),
      threats: [...new Set(results.flatMap(r => r.threats))],
      sanitized: results.map(r => r.sanitized)
    };
  }

  // Schema Builder Helpers
  static schema() {
    return new SchemaBuilder();
  }

  // Utility Methods
  generateCacheKey(input, schema) {
    return `${JSON.stringify(input)}_${JSON.stringify(schema)}`;
  }

  addToCache(key, result) {
    if (this.validationCache.size >= this.config.cacheSize) {
      const firstKey = this.validationCache.keys().next().value;
      this.validationCache.delete(firstKey);
    }
    this.validationCache.set(key, result);
  }

  getStats() {
    return { ...this.stats };
  }

  clearCache() {
    this.validationCache.clear();
  }
}

// Schema Builder Class
class SchemaBuilder {
  constructor() {
    this.schema = {};
  }

  type(type) {
    this.schema.type = type;
    return this;
  }

  required(required = true) {
    this.schema.required = required;
    return this;
  }

  options(options) {
    this.schema.options = options;
    return this;
  }

  sanitize(sanitizers) {
    this.schema.sanitize = sanitizers;
    return this;
  }

  custom(rules) {
    this.schema.custom = rules;
    return this;
  }

  properties(properties) {
    this.schema.properties = properties;
    return this;
  }

  items(itemSchema) {
    this.schema.items = itemSchema;
    return this;
  }

  build() {
    return this.schema;
  }
}

// Usage Examples
const validator = new InputSecurityFramework({
  strictMode: true,
  maxInputLength: 5000,
  htmlSanitization: {
    allowedTags: ['p', 'br', 'strong', 'em'],
    allowedAttributes: ['class']
  }
});

// Basic validation examples
const userInputSchema = InputSecurityFramework.schema()
  .type('string')
  .required()
  .options({ minLength: 3, maxLength: 100 })
  .sanitize({ html: {}, javascript: {} })
  .build();

const emailSchema = InputSecurityFramework.schema()
  .type('email')
  .required()
  .sanitize({ html: {} })
  .build();

// Validate user input
const userResult = validator.validate('Hello <script>alert("xss")</script> World', userInputSchema);
console.log('User input validation:', userResult);

// Validate email
const emailResult = validator.validate('user@example.com', emailSchema);
console.log('Email validation:', emailResult);

// Complex object validation
const userProfileSchema = InputSecurityFramework.schema()
  .properties({
    name: InputSecurityFramework.schema()
      .type('string')
      .required()
      .options({ minLength: 2, maxLength: 50 })
      .sanitize({ html: {} })
      .build(),
    email: InputSecurityFramework.schema()
      .type('email')
      .required()
      .sanitize({ html: {} })
      .build(),
    age: InputSecurityFramework.schema()
      .type('number')
      .options({ min: 0, max: 120, integer: true })
      .build(),
    website: InputSecurityFramework.schema()
      .type('url')
      .options({ allowedProtocols: ['http', 'https'] })
      .sanitize({ url: {} })
      .build()
  })
  .build();

const userProfile = {
  name: 'John <script>alert("hack")</script> Doe',
  email: 'john@example.com',
  age: 30,
  website: 'https://johndoe.com'
};

const profileResult = validator.validate(userProfile, userProfileSchema);
console.log('Profile validation:', profileResult);

// Batch validation
const inputs = ['test1', 'test2', 'test3'];
const schema = InputSecurityFramework.schema()
  .type('string')
  .options({ minLength: 3 })
  .build();

const batchResult = validator.validateBatch(inputs, [schema]);
console.log('Batch validation:', batchResult);

// Context-aware sanitization
const htmlContent = '<p>Hello <script>alert("xss")</script> World</p>';
const sanitizedForHtml = validator.sanitizeForContext(htmlContent, 'html');
const sanitizedForJs = validator.sanitizeForContext(htmlContent, 'javascript');

console.log('HTML sanitized:', sanitizedForHtml);
console.log('JS sanitized:', sanitizedForJs);

// Security threat detection
const maliciousInput = "'; DROP TABLE users; --";
const threats = validator.performSecurityScan(maliciousInput);
console.log('Detected threats:', threats);

// Get statistics
console.log('Validation statistics:', validator.getStats());

export { InputSecurityFramework, SchemaBuilder };

This comprehensive input validation and sanitization framework provides enterprise-grade protection against injection attacks, XSS, and other security threats while maintaining flexible validation rules and context-aware sanitization for building secure, robust web applications.

Understanding the Input Security Framework Code

Now let's break down how this comprehensive framework works and why each component is essential for robust input security.

1. Framework Architecture Overview

The Core Philosophy: The InputSecurityFramework class follows a defense-in-depth approach, implementing multiple validation and sanitization layers that work together to protect your application.

Key Components Breakdown:

Configuration System:

this.config = {
  strictMode: config.strictMode !== false,
  maxInputLength: config.maxInputLength || 10000,
  enableXssDetection: config.enableXssDetection !== false,
  // ... more options
};

Why This Matters:

Flexible Security Levels: You can adjust protection based on your application's needs
Environment-Specific Settings: Different configurations for development vs production
Performance Tuning: Balance security with application performance requirements

2. Security Pattern Detection System

The Theory Behind Pattern Matching: Instead of trying to sanitize every possible attack, we first detect malicious patterns and reject them entirely. This is more secure than trying to "clean" malicious input.

Pattern Categories Explained:

XSS Detection Patterns:

xss: [
  /<script[^>]*>.*?<\/script>/gi,  // Script tag injection
  /javascript:/gi,                // JavaScript protocol
  /on\w+\s*=/gi,                 // Event handler injection
]

How This Works:

Script Tags: Detects <script>alert('xss')</script> attempts
JavaScript Protocol: Catches javascript:alert('xss') in links
Event Handlers: Identifies onclick="malicious()" attributes

SQL Injection Patterns:

sqlInjection: [
  /(\bunion\b|\bselect\b|\binsert\b)/gi,  // SQL keywords
  /(\bor\b|\band\b)\s+[\w\s]*\s*[=<>]/gi, // Boolean injection
  /['"][\s]*;[\s]*--/gi,                   // Comment injection
]

How This Protects You:

Keyword Detection: Identifies SQL commands in user input
Boolean Logic: Catches admin' OR '1'='1 attacks
Comment Attacks: Stops '; DROP TABLE users; -- injections

3. Multi-Layer Validation System

Step 1: Basic Validation

validateValue(input, schema, context, path = '') {
  // Check if required field is missing
  if (input == null && schema.required) {
    result.isValid = false;
    result.errors.push(`${path || 'Value'} is required`);
  }
  
  // Length validation
  if (typeof input === 'string' && input.length > this.config.maxInputLength) {
    result.isValid = false;
    result.errors.push(`Input exceeds maximum length`);
  }
}

What's Happening Here:

Null Checks: Ensures required fields are present
Length Limits: Prevents buffer overflow and DoS attacks
Early Rejection: Fails fast for obviously invalid input

Step 2: Security Threat Detection

// Security threat detection
if (typeof input === 'string') {
  const threats = this.performSecurityScan(input);
  if (threats.length > 0) {
    result.threats = threats;
    if (this.config.strictMode) {
      result.isValid = false;
      result.errors.push(`Security threat detected: ${threats.join(', ')}`);
    }
  }
}

The Security Logic:

Pattern Scanning: Runs input against all attack patterns
Threat Classification: Identifies the type of attack attempted
Strict Mode: In production, reject any suspicious input immediately
Logging: Records attack attempts for security analysis

4. Context-Aware Sanitization

Why Context Matters: The same data needs different sanitization depending on how it's used:

sanitizeForContext(input, context) {
  switch (context) {
    case 'html':
      return this.sanitizers.html(input);      // For web page display
    case 'javascript':
      return this.sanitizers.javascript(input); // For JS string literals
    case 'sql':
      return this.sanitizers.sql(input);       // For database queries
    case 'url':
      return this.sanitizers.url(input);       // For URL components
  }
}

Sanitization Strategies Explained:

HTML Context:

html: (input, options = {}) => {
  // Remove dangerous tags
  sanitized = sanitized.replace(/<script[^>]*>.*?<\/script>/gi, '');
  
  // Encode HTML entities
  sanitized = sanitized
    .replace(/&/g, '&amp;')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;');
}

Why This Works:

Tag Removal: Eliminates script tags entirely
Entity Encoding: Converts < to < so browsers display it as text
Safe Display: Malicious code becomes harmless text

5. Schema-Based Validation System

The Schema Builder Pattern:

const userSchema = InputSecurityFramework.schema()
  .type('string')
  .required()
  .options({ minLength: 3, maxLength: 100 })
  .sanitize({ html: {}, javascript: {} })
  .build();

Why Schemas Are Powerful:

Reusability: Define validation rules once, use everywhere
Clarity: Self-documenting validation requirements
Consistency: Same validation logic across your application
Composability: Combine simple validators for complex rules

6. Performance Optimization Techniques

Caching Strategy:

// Check cache first
const cacheKey = this.generateCacheKey(input, schema);
if (this.config.enableCaching && this.validationCache.has(cacheKey)) {
  return this.validationCache.get(cacheKey);
}

Cache Benefits:

Speed: Repeated validation of similar inputs is instant
Resource Saving: Reduce CPU usage on complex validation
Scalability: Handle more users with same hardware

Batch Processing:

validateBatch(inputs, schemas) {
  const results = [];
  for (let i = 0; i < inputs.length; i++) {
    results.push(this.validate(inputs[i], schemas[i] || schemas[0]));
  }
  
  return {
    allValid: results.every(r => r.isValid),
    errors: results.flatMap(r => r.errors),
    sanitized: results.map(r => r.sanitized)
  };
}

Batch Processing Advantages:

Efficiency: Process multiple inputs in one operation
Atomic Operations: All-or-nothing validation for related fields
Error Aggregation: Collect all validation errors at once

7. Real-World Usage Patterns

Form Validation Example:

// User registration form
const profileResult = validator.validate(userProfile, userProfileSchema);
if (!profileResult.isValid) {
  // Show specific errors to user
  displayErrors(profileResult.errors);
} else {
  // Use sanitized data
  createUser(profileResult.sanitized);
}

What This Demonstrates:

User Experience: Provide helpful error messages
Security: Never trust user input, always validate
Data Integrity: Use sanitized version for processing

API Security Example:

// API endpoint protection
app.post('/api/users', (req, res) => {
  const validation = validator.validate(req.body, apiSchema);
  
  if (!validation.isValid) {
    return res.status(400).json({
      error: 'Invalid input',
      details: validation.errors
    });
  }
  
  // Process with sanitized data
  processUserData(validation.sanitized);
});

API Security Benefits:

Early Rejection: Stop malicious requests at the gate
Error Handling: Provide structured error responses
Attack Logging: Track validation failures for security analysis

8. Security Monitoring and Analytics

Statistics Tracking:

this.stats = {
  validationsPerformed: 0,
  validationsFailed: 0,
  securityThreatsDetected: 0,
  sanitizationsPerformed: 0
};

Why Statistics Matter:

Security Intelligence: Identify attack patterns
Performance Monitoring: Track validation overhead
Compliance: Prove due diligence in security measures
Optimization: Find bottlenecks and improve performance

Summary

Input validation and sanitization represent the critical first line of defense in web application security, protecting against injection attacks, data corruption, and security vulnerabilities through comprehensive validation rules and context-aware sanitization. By implementing multi-layered input security with both client-side and server-side validation, applications can ensure data integrity, prevent malicious attacks, and maintain user trust through robust input handling mechanisms.

Input Security Excellence Benefits:

Attack Prevention: Protect against XSS, SQL injection, command injection, and other input-based attacks through comprehensive pattern detection and sanitization
Data Integrity: Ensure data quality and consistency through strict validation rules and type checking across all application inputs
Context-Aware Protection: Apply appropriate sanitization based on how data will be used (HTML display, database storage, shell commands, etc.)
Performance Optimization: Implement efficient validation with caching, batch processing, and optimized pattern matching for high-performance applications

Advanced Security Capabilities:

Threat Intelligence: Detect and respond to sophisticated attack patterns through machine learning and pattern recognition algorithms
Defense in Depth: Implement multiple validation layers with fail-safe mechanisms and comprehensive error handling
Compliance Support: Meet regulatory requirements through comprehensive input validation and security audit trails
Developer Experience: Provide intuitive schema builders and validation APIs that make secure coding easier and more maintainable

Validation Architecture Patterns:

Schema-Driven Validation: Define comprehensive validation rules through declarative schemas and reusable validation components
Context-Sensitive Processing: Apply different validation and sanitization strategies based on input source and intended usage
Real-Time Validation: Provide immediate feedback to users while maintaining server-side validation authority
Security Monitoring: Track validation failures and security threats for continuous improvement and threat intelligence

Input validation and sanitization transform applications from vulnerable targets into secure fortresses that intelligently process user data while maintaining security, performance, and usability through comprehensive input security architectures.

Robust input validation doesn't just prevent attacks—it creates a foundation of trust where applications can confidently process user data while maintaining security, integrity, and performance at scale.

Input Validation and Sanitization