Defensive Programming: Input Validation

Students learn defensive programming best by actively testing real-world risks in controlled settings. When they see how missing checks allow simple inputs to break systems, the need for validation becomes immediate and personal. Pair work and simulations turn abstract concepts into concrete lessons that stick.

• Secondary 4
• Computing
• 4 activities
• 20 min–40 min

Learning Objectives

1. Design input validation rules for a user registration form to prevent common web exploits.
2. Analyze the security risks associated with inadequate input validation in web applications.
3. Explain how techniques like type checking, length limits, and character escaping mitigate specific threats.
4. Critique existing code for vulnerabilities related to improper input handling.
5. Demonstrate the implementation of input validation in a simple web application context.

Collaborative Problem-Solving

⏱ 30 min·Pairs

Pair Programming: Validation Function Challenge

Pairs receive a basic user registration form code with no validation. They add checks for email format, password strength, and username length, then test with invalid inputs. Partners alternate coding and testing roles every 10 minutes.

Prepare & details

How can input validation prevent common exploits like SQL injection and cross-site scripting?

Facilitation Tip: During Pair Programming: Validation Function Challenge, circulate and remind pairs to swap roles every 10 minutes so both students engage with the logic.

Setup: Groups at tables with problem materials

Materials: Problem packet, Role cards (facilitator, recorder, timekeeper, reporter), Problem-solving protocol sheet, Solution evaluation rubric

• Apply
• Analyze
• Evaluate
• Create
• Relationship Skills
• Decision-Making
• Self-Management

Collaborative Problem-Solving

⏱ 40 min·Small Groups

Small Groups: Attack Simulation Lab

Groups get vulnerable code snippets prone to SQL injection. They input malicious payloads, observe failures, then implement parameterized queries and input sanitization. Groups share one successful fix with the class.

Prepare & details

Analyze the potential risks of inadequate input validation in web applications.

Facilitation Tip: During Attack Simulation Lab, provide one intentionally vulnerable form per group and a checklist of common payloads to test against.

Setup: Groups at tables with problem materials

Materials: Problem packet, Role cards (facilitator, recorder, timekeeper, reporter), Problem-solving protocol sheet, Solution evaluation rubric

• Apply
• Analyze
• Evaluate
• Create
• Relationship Skills
• Decision-Making
• Self-Management

Collaborative Problem-Solving

⏱ 25 min·Whole Class

Whole Class: Code Review Hunt

Display anonymized student code on the board or shared screen. Class votes on risky inputs, discusses fixes collectively, and votes again on improved versions. Teacher facilitates with probing questions.

Prepare & details

Design a set of input validation rules for a user registration form.

Facilitation Tip: During Code Review Hunt, display snippets on the board without line numbers so students focus on structure, not line counting.

Setup: Groups at tables with problem materials

Materials: Problem packet, Role cards (facilitator, recorder, timekeeper, reporter), Problem-solving protocol sheet, Solution evaluation rubric

• Apply
• Analyze
• Evaluate
• Create
• Relationship Skills
• Decision-Making
• Self-Management

Collaborative Problem-Solving

⏱ 20 min·Individual

Individual: Rule Design Portfolio

Each student designs validation rules for three form fields, codes them, and documents test cases with screenshots of passes and fails. Submit digitally for peer review next lesson.

Prepare & details

How can input validation prevent common exploits like SQL injection and cross-site scripting?

Facilitation Tip: During Rule Design Portfolio, ask each student to include a reflection on one rule they initially missed and how the activity helped them catch it.

Setup: Groups at tables with problem materials

Materials: Problem packet, Role cards (facilitator, recorder, timekeeper, reporter), Problem-solving protocol sheet, Solution evaluation rubric

• Apply
• Analyze
• Evaluate
• Create
• Relationship Skills
• Decision-Making
• Self-Management

Teaching This Topic

Start with the Attack Simulation Lab to make threats visible before theory. Use Code Review Hunt to build a shared vocabulary for vulnerabilities. End with Rule Design Portfolios so students apply lessons to their own design decisions. Avoid teaching validation as a separate step; integrate it into every example from the first lesson.

What to Expect

By the end of the activities, students will write validation functions that handle edge cases, explain why layered checks matter, and recognize vulnerabilities in sample code. They will shift from assuming safety to actively proving security through testing.

Watch Out for These Misconceptions

Common Misconception

During Pair Programming: Validation Function Challenge, watch for students assuming their partner's test cases cover all risks.

What to Teach Instead

After the challenge, require each pair to exchange their test cases with another pair and add at least two new edge cases based on the exchanged materials.

Common Misconception

During Attack Simulation Lab, watch for students believing length checks alone stop all injections.

What to Teach Instead

During the lab, provide a second form with only length checks and challenge groups to craft an input that bypasses it without exceeding character limits.

Common Misconception

During Rule Design Portfolio, watch for students dismissing validation overhead as insignificant.

What to Teach Instead

Ask students to benchmark their validation code against a version without checks using sample data they collected, then calculate the cost of a breach versus the overhead shown.

Assessment Ideas

Quick Check

After Pair Programming: Validation Function Challenge, display a new snippet with missing validation for a search field. Students have 5 minutes to identify two vulnerabilities and propose fixes, then share with a partner for feedback.

Exit Ticket

During Code Review Hunt, students submit one validation rule they would add to a comment form and explain how it prevents a specific attack type. Collect these to assess understanding of layered defenses.

Discussion Prompt

After Attack Simulation Lab, facilitate a class discussion where groups present one attack they successfully blocked and one they missed. Use the misses to highlight gaps in their validation strategy.

Extensions & Scaffolding

• Challenge: Ask students to design validation for a file upload field that prevents malicious file extensions while still allowing common image formats.
• Scaffolding: Provide a starter template with type-checking already in place but missing sanitization steps.
• Deeper exploration: Explore how to integrate validation with logging so failed checks generate alerts for monitoring.

Key Vocabulary

Input Validation	The process of checking user-supplied data to ensure it conforms to expected formats, types, and constraints before it is processed by an application.
SQL Injection	A cyberattack where malicious SQL code is inserted into input fields, allowing an attacker to manipulate database queries and access sensitive information.
Cross-Site Scripting (XSS)	A type of web security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially stealing session cookies or redirecting users.
Sanitization	The process of cleaning or modifying input data to remove or neutralize potentially harmful characters or code, making it safe for processing.
Type Checking	Verifying that user input matches the expected data type, such as ensuring a number field only contains digits.