A web administrator develops a web form for users to respond to the company via a web page. Which of the following should be practiced to avoid a security risk?

SQL injection is an attack technique and vulnerability class, not a security practice - it describes what the developer should protect against, not what should be implemented.

XSS (cross-site scripting) is also an attack category and vulnerability, not a defensive practice that can be implemented on a web form.

Clickjacking is a UI redress attack technique, not a security control or practice that a web form developer would implement.

Input validation ensures that data submitted through web forms is checked for type, length, format, and range before being processed or stored. By sanitizing and validating all user-supplied input, the developer removes the attack surface for injection-based vulnerabilities such as SQL injection and cross-site scripting at the source.