Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am new to IT Security and I have been tasked with coming up with input and output validation for ESAPI.

So for input validation, so far I got:

Data Type   
Account Number      
Zip code                               
CC Number   
Expiry Month    
Expiry Year 

But I do not understand how output validation works. Could anyone please explain it to me with a few examples?

share|improve this question

closed as too broad by tylerl, TildalWave, NULLZ, Gilles, Adi Aug 2 '13 at 9:19

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

You should be thinking of output encoding, rather than output validation.

Output encoding is about properly escaping special characters so they appear correctly to the user, rather than getting interpreted with their special meaning.

For example if your field contains One is < Two, and you are showing this on a HTML page, then you need to encode it as One is &lt; Two. To do this with ESAPI, you would use the encodeForHTML method.

The characters that you need to encode, and the way to encode them will vary depending where you are using the data.

For example, if you are using One is < Two as part of a URL, the spaces also need to be encoded, and the less than sign becomes %3C, and the result will be One%20is%20%3C%20Two. To do this with ESAPI, you would use the encodeForURL method.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.