Study. uk . com
  1. Home
  2. All questions
  3. Question 147

CompTIA Security+ study material · question 147 of 611

A team validates all input strictly and concludes that output encoding is unnecessary. Why is that wrong?

  1. Validation applies only to numeric fields
  2. Validation decides whether to accept data; encoding decides how to render it safely in a given context
  3. Validation cannot check the length of a field
  4. Encoding is required only for database writes
Show the answer

Answer: B. Validation decides whether to accept data; encoding decides how to render it safely in a given context

The two answer different questions, and legitimate accepted data can still be dangerous in an HTML or script context.

Source: OWASP Input Validation Cheat Sheet (OWASP) — OWASP Input Validation Cheat Sheet › Introduction

Challenge yourself on this topic → Study as cards