Websites' Input Validation and Input-Misuse-Based Attacks

Websites typically include many forms or web elements that allow users to enter and submit data. This data will be eventually executed in the back-end databases. Users can, intentionally or unintentionally enter improper input data that, if reach those back-end databases, may cause some serious security or damaging problems. For proper user interface design as well as for security reasons, it is important for web-designers to consider input-validation techniques at the user interface level or as early as possible. The goal is to stop further actions for any invalid input data. In this paper, we conducted an evaluation study of how much input validation is used by web-designers. We used some of the web attacks that target improper input validations as indicators to show the quality of the input validation process for the evaluated websites. Results showed that those types of attacks continue to be effective and serious methods. Results showed also that there is a need for systematic and frequent evaluation for those websites to ensure that basic input validation guidelines are observed.