A security consultant is evaluating forms which will be used on a company website. Which of the following techniques or terms is MOST effective at preventing malicious individuals from successfully…

Anti-spam software filters unwanted email content and has no relevance to validating data submitted through web forms.

Application sandboxing restricts an application's access to system resources but does not prevent malicious input from being processed within the application's own logic.

Data loss prevention tools detect and block sensitive data exfiltration but do not prevent attackers from exploiting web application input handling flaws.

Input validation prevents attackers from injecting malicious data - such as SQL commands, scripts, or path traversal strings - into application inputs by enforcing type, length, format, and range checks before data is processed. It directly addresses programming flaws like injection vulnerabilities and cross-site scripting at the source. Without proper input validation, all other controls are secondary mitigations that do not fix the underlying flaw.