Study. uk . com
  1. Home
  2. All questions
  3. Question 469

CISSP study material · question 469 of 500

A team relies solely on positive server-side input validation to stop injection. Why does OWASP describe this as incomplete?

  1. Many applications legitimately require special characters, for example in free text areas and mobile interfaces.
  2. Validation is only effective where the interpreter is a relational database.
  3. Validation cannot be applied to structured request bodies such as JSON.
  4. Validation runs after the query is constructed and so arrives too late.
Show the answer

Answer: A. Many applications legitimately require special characters, for example in free text areas and mobile interfaces.

OWASP calls positive server-side input validation not a complete defence, because many applications require special characters, such as text areas or interfaces for mobile applications.

Source: OWASP Top 10 A05:2025 (OWASP) — OWASP Top 10:2025 A05 Injection > How to prevent

Challenge yourself on this topic → Study as cards