Never Trust User Input

Applications must treat all user input and, more generally, all third-party data as attacker-controlled data.

The application must determine where the third-party data comes from and treat that data source as an attack vector. Two rules apply:

First, before using it in the application's business logic, the application must validate the attacker-controlled data against predefined formats, such as:

Second, the application must sanitize string data before inserting it into interpreted contexts (client-side code, file paths, SQL queries). Unsanitized code can corrupt the application's logic.