miji.beInput validation is the process of verifying whether input data from users matches the expected format and range. OWASP states that SQL injection and XSS require parameterized queries and contextual output encoding in addition to input validation.
Input validation methods include the whitelist approach (defining the patterns to allow and rejecting everything else) and the blacklist approach (defining the patterns to prohibit and allowing everything else). OWASP asks that applications define the values they accept and reject everything else, rather than trying to identify every malicious string.
In URL shorteners, the URLs that users enter are also subject to validation. Items to check include, for example, the URL format (compliance with RFC 3986), that the protocol is http:// or https:// (excluding the javascript: scheme), that the domain is not on a blacklist (excluding phishing sites), and that the URL length is within the limit. OWASP's guide to XSS prevention gives allowing only http and https URLs as an example of a countermeasure for untrusted URLs placed in href or src attributes.
OWASP's guide to input validation recommends validating on the server side even when the same items are checked in the browser, and using client-side validation, which can be bypassed, for immediate feedback.