A penetration tester noticed special characters in a database table. The penetration tester configured the browser to use an HTTP interceptor to verify that the front-end user registration web form…

This uses negative (blacklist) validation that checks for specific bad characters; blacklists are inherently incomplete and can be bypassed with unlisted special characters or encoding tricks.

The expression IF $AGE == [1234567890]{1,3} THEN CONTINUE implements positive (allowlist) input validation by specifying exactly which characters are permitted (digits 0-9) and constraining input length (1 to 3 characters). This approach rejects all non-numeric and out-of-range input by default, directly preventing SQL injection and special character injection without relying on a blacklist of known-bad characters.

This is a negative check (!=) against a blacklist of bad characters, which is inferior to allowlist validation and still susceptible to bypass via omitted characters.

The pattern [1-0] is an invalid regex range (1 to 0 is empty) and {0,2} would allow zero-length input, making this both logically incorrect and insecure.