Input Validation Pipeline (2D)

Defensive Stages

1. Length check

2. Allow-list charset

3. Char-class / keyword scan

4. Encoding normalization

Parameters

Max length threshold 64 chars

Malicious injection rate 40%

Submission rate 1 / 0.9s

Live Readout

Passed safely

Blocked

Passed UNSAFE

Total sent

Block rate

Attack catch rate

Caught by: length 0 · allow-list 0 · char-class 0 · encoding 0

How it works

Every payload below is a real string — not a random coin-flip. Each of the four stages genuinely inspects the text and can be independently switched off:

for stage in [length, allowList, charClass, encoding]:
  if stage.enabled and !stage.check(payload):
    block(payload); break
if not blocked and payload.isAttack: passedUnsafe++
else if not blocked: passedSafe++

Length check — rejects anything longer than the threshold slider, catching oversized/DoS-style payloads even when every character is harmless (e.g. a 400-char string of "A").
Allow-list charset — only letters, digits, spaces and a small set of punctuation (. , ' _ @ ! ? % -) pass; angle brackets, semicolons, equals signs and slashes used by HTML/SQL metacharacters are rejected outright.
Char-class / keyword scan — a payload built entirely from allow-listed characters can still be an attack (SELECT password FROM users uses only letters and spaces). This stage scans for dangerous sequences and SQL/JS keywords the charset check cannot see.
Encoding normalization — percent-decodes the payload once and re-runs the charset and keyword checks against the decoded text, catching payloads like %3Cb%3E (decodes to <b>) or a %00 null-byte extension bypass that look clean before decoding.

Turn a stage off and watch its class of payload sail straight through — the "passed UNSAFE" counter and the attack catch-rate readout make the defense-in-depth argument directly measurable: no single layer catches everything, and raising the malicious-injection-rate slider stresses whichever layers remain on.

Legitimate input Attack / malformed payload Blocked at this gate Passed through UNSAFE

Input Validation Pipeline (2D)

This 2D companion drives the same defense-in-depth idea as the 3D pipeline through a plain canvas view built for reading the validation logic rather than orbiting a scene. Real SQL-injection fragments, XSS fragments, oversized strings and null-byte tricks are drawn from an actual payload pool and flow left to right through four genuinely evaluating stages — a length check, an allow-list charset check, a character-class/keyword scan, and an encoding-normalization check that re-validates the payload after percent-decoding it. Toggle any stage off, drag the max-length threshold or the malicious-injection-rate slider, and watch the live per-stage catch-rate breakdown change in real time.