Secure User Input and Prevent Vulnerabilities

This skill implements input sanitization, validation, and encoding, treating all user input as potentially malicious and applying layered security controls. Core distinction: validation rejects invalid input outright, sanitization cleans/modifies input to make it safe, and encoding transforms input for safe use in a specific output context - applied in that order (validate first, sanitize if needed, encode for the output context). Defense-in-depth principles: never rely on client-side validation alone, validate at multiple layers (input, business logic, data access), prefer allowlists over denylists, and fail securely by rejecting invalid input rather than trying to fix it.

Use it when user input crosses a trust boundary into HTML, JavaScript, SQL, a file system, or a redirect URL, and each context needs its own correct encoding or validation - not a single generic "sanitize" function applied everywhere.

class InputValidator:
    PATTERNS = {
        'email': r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$',
        'username': r'^[a-zA-Z0-9_]{3,20}$',
    }

    @staticmethod
    def validate_input(value, pattern_type, max_length=255):
        if not value or len(value) > max_length:
            return None
        pattern = InputValidator.PATTERNS.get(pattern_type)
        if pattern and re.match(pattern, value):
            return value.strip()
        return None

Context-specific encoding is shown for HTML output (html.escape with additional quote/backtick handling for attribute contexts) and JavaScript (escaping backslashes, quotes, and angle brackets, plus a safe JSON-stringify that escapes </>/&). SQL access always goes through parameterized queries - the example explicitly validates the input first, then executes with bound parameters, never string formatting. File upload sanitization strips path components and disallowed characters from filenames, enforces an extension and MIME-type allowlist plus a 10MB size cap, and cross-checks the declared MIME type against the type detected from the filename. URL sanitization validates redirect targets against an allowlist of hosts and schemes to prevent open redirects, and path-parameter sanitization normalizes the path and rejects .. traversal attempts or absolute paths, confirming the resolved path still falls under the intended base directory. A Content-Security-Policy header helper sets CSP, X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, and HSTS together.

Backend developers handling user input across multiple output contexts (HTML, JS, SQL, file uploads, redirects) who need the correct validation and encoding for each context rather than one sanitization function applied blindly everywhere. The summary distills it into ten rules: never trust input, prefer allowlists, encode per output context, always parameterize SQL, enforce length limits, validate uploaded content-type against the actual file, ship security headers, keep sanitization libraries current, log validation failures for monitoring, and include malicious input directly in the test suite rather than assuming it will never arrive.