How do input validation and output encoding contribute to security?

• A. Input validation ensures data can be any type; output encoding converts data to strings.
• B. Input validation ensures only expected data enters; output encoding prevents injection and XSS by escaping potentially harmful characters.
• C. Input validation is unnecessary if there is encryption.
• D. Output encoding is used to compress data for network transfer.

Answer: (B)

Input validation and output encoding work together to reduce the attack surface by controlling data at two critical points: entry and rendering. Validating input means checking that incoming data matches what you expect in terms of type, format, length, and value range, and then accepting, normalizing, or rejecting it accordingly. This stops malformed or malicious data from entering downstream processes such as database queries or command execution, which could be exploited if left unchecked.

Output encoding focuses on how data is presented back to the user or used in different contexts. When you render user-supplied data in HTML, JavaScript, or URLs, encoding escapes the dangerous characters so they are treated as data rather than executable code. This prevents injection attacks like XSS, where an attacker could inject scripts that run in a victim’s browser.

So, input validation gates what enters the system, while output encoding gates what leaves in a form that can’t be misused in its destination. Encryption or compression don’t replace these protections—encryption hides content but doesn’t validate it, and compression isn’t about preventing code execution.