Input is not validated

Why It Shows Up

The scan found input from a request superglobal being used without validation such as capability checks, allowlists, type checks, or range checks.

Why It Matters

Sanitization cleans a value, but validation proves the value is acceptable. Missing validation can allow unexpected actions, invalid states, or unsafe query choices.

How to Fix

• Check that IDs are positive integers, enum-like values are in an allowlist, and URLs or file paths are constrained.
• Pair state-changing requests with nonce and capability checks.
• Reject or safely default values that do not pass validation.

References