Input Validation Pipeline | mysimulator.uk

Inject Payload

Submission rate 1 / 1.4s

Defensive Stages

1. Type check

2. Length / range

3. Allow-list pattern

4. Encode / escape

Blocked

Passed safely

Passed UNSAFE

Total sent

How it works

Each submission carries hidden properties: a wrong data type, an over-length value, a pattern that fails an allow-list (SQL/HTML metacharacters), and unescaped characters that would break out of their context. A stage only stops a packet whose relevant property is present, and only while that stage is switched on. Turn a stage off and packets with that exact flaw sail straight through — the model of "defense in depth": no single layer catches everything, so removing any one of them lets its class of flaw leak into the application unsafely.

for stage in [type, length, pattern, encode]:
  if stage.enabled and payload.triggers(stage):
    block(payload); break
if not blocked and payload.hasAnyFlaw: passedUnsafe++
else if not blocked: passedSafe++

Type check — rejects a value that isn't the expected kind (e.g. text where a number was required). Catches malformed submissions.
Length / range check — rejects a value that is implausibly long or out of bounds. Also catches malformed submissions and oversized attack payloads.
Allow-list pattern check — only accepts characters/shapes on an explicit allow-list, so quotes, angle brackets and SQL keywords used in an injection attempt are rejected outright.
Encode / escape — the last line of defense: even a payload that slipped past every filter gets its special characters escaped before use, so it can no longer break out of its SQL/HTML context.

Real-world relevance: this is the OWASP-recommended layered approach to input validation — never rely on a single check, because attackers craft payloads specifically to slip past the first filter they meet. This sim is deliberately about the pipeline, not a single injection exploit — compare with the "SQL Injection & XSS Demo" sim, which shows what happens when validation is absent altogether.

Normal submission Malformed submission Injection attempt Stage active & blocking

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.