Input Validation Skill

Purpose

Defines input validation and sanitization patterns for preventing security vulnerabilities and ensuring data integrity.

Core Principles

1. Validate all input — Never trust user-supplied data
2. Allowlist over denylist — Define what IS allowed
3. Validate on server-side — Client-side validation is UX only
4. Encode output — Context-appropriate encoding
5. Fail securely — Reject invalid input with safe defaults

HTML/Static Site Validation

• Sanitize any user-generated content before rendering
• Use textContent instead of innerHTML when possible
• Escape HTML entities (&, <, >, ", ')
• Validate URL inputs (protocol allowlist: https only)
• Use Content Security Policy (CSP) headers