Data Validation and Verification: Information Security Spring-2020
Data Validation and Verification: Information Security Spring-2020
Information security
Spring- 2020
Difference between Data Validation and Data Verification
• Go to any popular site with a registration form, and you will notice
that they give you feedback when you don't enter your data in the
format they are expecting. You'll get messages like:
• "This field is required" (you can't leave this field blank)
• "Please enter your phone number in the format xxx-xxxx" (it wants
three numbers followed by a dash, followed by four numbers)
• "Please enter a valid e-mail address" (the thing you've entered
doesn't look like a valid e-mail address)
• "Your password needs to be between 8 and 30 characters long,
and contain one uppercase letter, one symbol, and a number"
(seriously?)
• This is called form validation — when you
enter data, the web application checks it to
see if it is correct. If correct, the
application allows the data to be submitted to
the server and (usually) saved in a database; if
not, it gives you error messages to explain
what you've done wrong (provided you've
done it right).
• We want to make filling out web forms as painless
as possible, so why do we need to validate values
entered into forms before storing forms data into a
database? There are three main reasons:
• We want to get the right data, in the right
format — our applications won't work properly if
our user's data is stored in any old format they like,
or if they don't enter the correct information in the
correct places.
• We want to protect our users — if they
entered really easy passwords, or no password
at all, then malicious users could easily get
into their accounts and steal their data.
• We want to protect ourselves — there are
many ways that malicious users can misuse
unprotected forms to damage the application
they are part of.