All input from the user should be validated on the Server side as is required by the FSA Reference Architecture. Client Side validation is allowed to reduce network traffic; however, it is not a substitution for server side validation. Client side scripting does not provide a secure means of validating user input.

Particular attention should be paid to any inputs that are keys used to retrieve data, such as customer ids, payment id, and contract numbers, as they may allow a hacker to change their values and view information they should not be able to see. In these situations the user id should be validated to determine whether or not they have rights to view the information.

The following practices should provide improvement to a web application's input validation: