> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qaos.machdel.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Input Validation

> Issues where input fields accept data that violates expected type, format, or length constraints.

***

## user-input-not-validated

<Badge>Low</Badge>

**What it is**

Input fields accept data that violates the expected type, format, or length — such as letters in a numeric field, non-email strings in an email field, or extremely long strings in a text field with no length limit.

**Why it matters**

Missing input validation can cause:

* Application errors when invalid data reaches downstream processing
* Database constraint violations
* Unexpected behavior in business logic
* In some cases, performance issues from extremely long inputs

While lower severity than injection vulnerabilities, invalid inputs can trigger unexpected server behavior that aids further exploitation.

**How QAOS detects it**

The agent identifies form fields and submits type-mismatched, boundary-value, and special character payloads, observing whether the application accepts or rejects them:

* Numeric fields: submitting letters and special characters
* Email fields: submitting strings without `@`
* Text fields: submitting extremely long strings (10,000+ characters)
* Bounded fields: submitting values at and beyond stated limits

**Examples**

```
Age field: "twenty-five"        ← letters in numeric field
Email field: "notanemail"       ← missing @ symbol
Phone field: "+1 DROP TABLE"    ← special characters
Comment field: "A" * 50000      ← extremely long string
```

**How to fix**

Validate all inputs both **client-side** (for immediate user feedback) and **server-side** (for security). Client-side validation alone is never sufficient.

```javascript theme={null}
// HTML5 built-in validation
<input type="number" min="0" max="150" required>
<input type="email" required>
<input type="text" maxlength="500">

// Server-side validation with Zod (TypeScript)
const schema = z.object({
  age: z.number().int().min(0).max(150),
  email: z.string().email(),
  comment: z.string().max(500)
})

// Python with Pydantic
class UserInput(BaseModel):
    age: int = Field(ge=0, le=150)
    email: EmailStr
    comment: str = Field(max_length=500)
```

Return clear, specific error messages when validation fails so users know what to correct.