Sanitization Basics

Introduction

Sanitization is the process of cleaning and filtering user input to prevent harmful or unwanted data from entering a system. It is one of the most important practices in web development and cybersecurity because it helps protect websites, applications, and databases from attacks and errors.

Whenever users enter data into forms, search boxes, login pages, or upload systems, that information should be sanitized before it is stored or processed.

Objectives

By the end of this training, you will be able to:

• Understand the concept of sanitization
• Identify unsafe user input
• Learn why sanitization is important
• Apply sanitization techniques in web applications
• Prevent common security risks
• Improve data safety and application reliability

What is Sanitization

Sanitization means removing or modifying dangerous characters, scripts, or invalid data from user input before using it in an application.

Examples of user input include:

• Login forms
• Registration forms
• Search bars
• Contact forms
• File uploads
• Comment sections

Importance of Sanitization

Sanitization helps developers:

• Protect databases from malicious input
• Prevent website attacks
• Improve application security
• Ensure clean and valid data
• Reduce system vulnerabilities
• Maintain user trust

Common Security Risks Without Sanitization

SQL Injection

Attackers may insert harmful SQL commands into forms to access or damage databases.

Cross Site Scripting (XSS)

Malicious scripts can be injected into websites and executed in users’ browsers.

Command Injection

Unsafe input can execute harmful server commands.

Data Corruption

Invalid or unfiltered input may damage stored information.

Types of Sanitization

Input Sanitization

Cleaning data entered by users before processing.

Output Sanitization

Escaping or filtering data before displaying it on webpages.

File Sanitization

Checking uploaded files for harmful content or invalid formats.

Examples of Sanitization

Removing Special Characters

Unsafe Input:

<script>alert('Hacked')</script>

Sanitized Output:

alertHacked

Email Sanitization in PHP

<?php
$email = "user@@example.com";
$cleanEmail = filter_var($email, FILTER_SANITIZE_EMAIL);

echo $cleanEmail;
?>

HTML Special Characters

<?php
$userInput = "<b>Hello</b>";

echo htmlspecialchars($userInput);
?>

Input Validation vs Sanitization

Validation

Checks whether data follows the correct format or rules.

Example:

• Email format checking
• Password length checking

Sanitization

Cleans the data to make it safe for processing or storage.

Both validation and sanitization should be used together for maximum security.

Best Practices for Sanitization

• Never trust user input
• Sanitize all form data
• Use built in security functions
• Escape output before displaying data
• Validate uploaded files
• Keep software and libraries updated
• Use prepared statements for databases

Sanitization in Web Development

Sanitization is widely used in:

• PHP applications
• WordPress websites
• E commerce systems
• Login systems
• Contact forms
• APIs and web services

Benefits of Sanitization

• Better application security
• Safer databases
• Reduced cyber attacks
• Improved data quality
• Stronger user trust
• More stable applications

Real World Example

An online registration form accepts user input for names and emails. Without sanitization, attackers may insert harmful scripts or invalid data. Sanitization removes dangerous content before storing information in the database.

Final Presentation

In your final presentation, explain:

• What sanitization is
• Why sanitization is important
• Common security risks
• Difference between validation and sanitization
• Examples of sanitization techniques
• Best practices for secure applications