An organization recently updated its security policy to include the following statement: Regular expressions are included in source code to remove special characters such as $, |, ;. &, `, and ?…

The correct answer is C. Input validation. Input validation (C) is correct because the organization is using regular expressions to sanitize form input by stripping out dangerous special characters - this is a classic defensive coding technique that prevents injection attacks (SQL injection, command injection, etc.) by…

Submitted by hassan_iq· Mar 6, 2026Threats, vulnerabilities, and mitigations

Question

An organization recently updated its security policy to include the following statement:

Regular expressions are included in source code to remove special characters such as $, |, ;. &, `, and ? from variables set by forms in a web application. Which of the following best explains the security technique the organization adopted by making this addition to the policy?

Options

AIdentify embedded keys
BCode debugging
CInput validation
DStatic code analysis

How the community answered

(21 responses)

A
5% (1)
B
10% (2)
C
86% (18)

Explanation

Input validation (C) is correct because the organization is using regular expressions to sanitize form input by stripping out dangerous special characters - this is a classic defensive coding technique that prevents injection attacks (SQL injection, command injection, etc.) by ensuring user-supplied data doesn't contain malicious characters before processing.

Why the distractors are wrong:

A (Identify embedded keys) refers to finding hardcoded credentials or API keys in source code - completely unrelated to form input filtering.
B (Code debugging) is the process of finding and fixing software bugs, not a security control applied at runtime to user input.
D (Static code analysis) involves automated tools that scan source code for vulnerabilities without executing it - it's a review technique, not a runtime sanitization technique.

Memory tip: Think of the characters being filtered - $, |, ;, &, `, ? - these are shell/command metacharacters. Any time you see "stripping dangerous characters from user input," that's input validation (sometimes called input sanitization). The phrase "variables set by forms" is your signal that this is about controlling what users can submit.

Topics

#Input validation#Web application security#Regular expressions#Data sanitization

Community Discussion

No community discussion yet for this question.

Full SY0-701 Practice