A security consultant is evaluating forms which will be used on a company website. Which of the following techniques or terms is MOST effective at preventing malicious individuals from successfully…

Anti-spam software filters unsolicited email and messaging content but provides no protection against exploitation of web form input-handling flaws.

Application sandboxing limits the damage an exploited application can cause by isolating its runtime environment, but it does not prevent the initial exploit from succeeding.

Data loss prevention monitors and restricts the movement of sensitive data out of the organization but does not prevent attackers from injecting malicious input through web forms.

Input validation is the most effective preventive control against web form exploits such as SQL injection and cross-site scripting because it sanitizes or rejects malicious data at the point of entry before the application processes it. By enforcing constraints on data type, length, format, and range, it neutralizes the attacker's ability to craft payloads that exploit programming flaws. All other options operate downstream and do not address the vulnerability at its source.