Secure User Input and Prevent Vulnerabilities

This skill provides expert guidance on input validation, sanitization, and encoding to prevent injection attacks and ensure data integrity, treating all user input as potentially malicious. It distinguishes three concepts applied in order - validation rejects invalid input entirely, sanitization cleans input to make it safe, encoding transforms input for safe use in a specific output context - and requires defense in depth: never rely on client-side validation alone, validate at multiple layers (input, business logic, data access), prefer allowlists over denylists, and fail securely by rejecting rather than attempting to fix invalid input. Strict validation is shown via an InputValidator class with allowlist regex patterns for email, username, phone, alphanumeric, and safe-filename inputs, plus a bounded integer validator.

Use it when implementing input validation, sanitization, or output encoding to defend against injection attacks (XSS, SQL injection, open redirects, directory traversal) or when auditing existing handling of user-supplied data for these gaps.

Context-specific encoding is covered per output target: HTML encoding via html.escape plus extra quote/backtick escaping for attribute contexts; JavaScript-context encoding via a JSEncoder class escaping backslashes, quotes, newlines, and </> as unicode escapes, with a safeJSONStringify variant; and SQL, where the rule is always parameterized queries via a SafeDatabaseAccess class that never builds queries with string formatting, validating the input (e.g. an email) before it ever reaches the query. File upload sanitization strips path components and disallowed characters from filenames, checks file size against a 10MB limit, cross-checks extension against an allowlist (.jpg, .png, .pdf, etc.), verifies the declared MIME type against an allowlist, and confirms the MIME type actually matches the file content via mimetypes.guess_type. URL and path sanitization prevents open redirects by validating scheme (http/https only) and host against an allowlist, and prevents directory traversal by normalizing the path, rejecting .. or a leading /, and confirming the resolved path stays inside the base directory. A security-headers helper applies a Content-Security-Policy, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, X-XSS-Protection, and HSTS.

Python (re, html, markupsafe, sqlite3, mimetypes, pathlib, urllib.parse) and JavaScript encoding utilities are the reference implementations; the parameterized-query pattern generalizes to any SQL database driver.

Developers implementing or reviewing input handling who need concrete, context-aware sanitization and encoding patterns - allowlist validation, parameterized queries, safe file uploads, open-redirect and path-traversal prevention, and security headers - rather than a single generic "sanitize the input" rule. Best-practice summary: never trust input, use allowlists, encode per context, always parameterize SQL, enforce length limits, validate content-type on uploads, apply security headers, keep sanitization dependencies current, log validation failures, and test with malicious input.