🔒 Security: Input Validation

🎯 Introduction

Welcome to this critical tutorial on input validation in Python! 🎉 In this guide, we’ll explore how to protect your applications from malicious input and ensure data integrity.

You’ll discover how proper input validation can be the difference between a secure application and a security breach! Whether you’re building web applications 🌐, APIs 🔌, or command-line tools 💻, understanding input validation is essential for writing secure, robust code.

By the end of this tutorial, you’ll feel confident implementing bulletproof input validation in your Python projects! Let’s dive in! 🏊‍♂️

📚 Understanding Input Validation

🤔 What is Input Validation?

Input validation is like a bouncer at a club 🕺 - it checks everyone at the door and only lets in the good ones! Think of it as a security checkpoint ✅ that examines all incoming data before it enters your application.

In Python terms, input validation is the process of ensuring that user-provided data meets specific criteria before processing it. This means you can:

• ✨ Prevent security vulnerabilities like SQL injection
• 🚀 Ensure data integrity and consistency
• 🛡️ Protect against application crashes and unexpected behavior

💡 Why Use Input Validation?

Here’s why input validation is non-negotiable:

1. Security First 🔒: Prevent injection attacks and malicious code execution
2. Data Quality 💎: Ensure only valid data enters your system
3. User Experience 😊: Provide clear feedback for incorrect input
4. System Stability 🏗️: Prevent crashes from unexpected data

Real-world example: Imagine a banking application 🏦. Without input validation, someone could enter negative amounts or SQL commands instead of numbers - catastrophic! 💥

🔧 Basic Syntax and Usage

📝 Simple Example

Let’s start with basic validation techniques:

# 👋 Hello, secure Python!
def validate_age(age_input):
    """🎂 Validate age input"""
    try:
        # 🔄 Convert to integer
        age = int(age_input)
        
        # ✅ Check valid range
        if 0 <= age <= 150:
            return age
        else:
            raise ValueError("Age must be between 0 and 150")
    except ValueError as e:
        # ❌ Invalid input
        raise ValueError(f"Invalid age: {str(e)}")

# 🎮 Test it out!
try:
    user_age = validate_age("25")
    print(f"✅ Valid age: {user_age}")
except ValueError as e:
    print(f"❌ Error: {e}")

💡 Explanation: Notice how we validate both the type (must be convertible to int) and the range (0-150). Always validate both format and business rules!

🎯 Common Validation Patterns

Here are patterns you’ll use daily:

import re
from datetime import datetime

# 🏗️ Pattern 1: Email validation
def validate_email(email):
    """📧 Validate email format"""
    pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
    if re.match(pattern, email):
        return email.lower()  # 🎨 Normalize to lowercase
    raise ValueError("Invalid email format")

# 🎨 Pattern 2: Phone number validation
def validate_phone(phone):
    """📱 Validate phone number"""
    # Remove spaces and dashes
    cleaned = re.sub(r'[\s\-\(\)]', '', phone)
    
    # Check if it's digits only and correct length
    if cleaned.isdigit() and 10 <= len(cleaned) <= 15:
        return cleaned
    raise ValueError("Invalid phone number")

# 🔄 Pattern 3: Date validation
def validate_date(date_string, format='%Y-%m-%d'):
    """📅 Validate date string"""
    try:
        return datetime.strptime(date_string, format)
    except ValueError:
        raise ValueError(f"Invalid date format. Expected: {format}")

💡 Practical Examples

🛒 Example 1: E-commerce Input Validation

Let’s build a secure product order system:

import re
from decimal import Decimal
from typing import Dict, List

class OrderValidator:
    """🛍️ Validates e-commerce order data"""
    
    def __init__(self):
        self.errors: List[str] = []
    
    def validate_product_name(self, name: str) -> str:
        """📦 Validate product name"""
        # 🛡️ Remove whitespace
        name = name.strip()
        
        # ✅ Check length
        if not name:
            raise ValueError("Product name cannot be empty")
        if len(name) > 100:
            raise ValueError("Product name too long (max 100 chars)")
        
        # 🔒 Check for invalid characters
        if re.search(r'[<>\"\'&]', name):
            raise ValueError("Product name contains invalid characters")
        
        return name
    
    def validate_quantity(self, quantity: str) -> int:
        """🔢 Validate quantity"""
        try:
            qty = int(quantity)
            if qty <= 0:
                raise ValueError("Quantity must be positive")
            if qty > 1000:
                raise ValueError("Quantity too large (max 1000)")
            return qty
        except ValueError:
            raise ValueError("Invalid quantity format")
    
    def validate_price(self, price: str) -> Decimal:
        """💰 Validate price"""
        try:
            # 🎯 Use Decimal for money!
            price_decimal = Decimal(str(price))
            if price_decimal <= 0:
                raise ValueError("Price must be positive")
            if price_decimal > 1000000:
                raise ValueError("Price too high")
            # 💡 Round to 2 decimal places
            return price_decimal.quantize(Decimal('0.01'))
        except:
            raise ValueError("Invalid price format")
    
    def validate_credit_card(self, card_number: str) -> str:
        """💳 Validate credit card number (basic)"""
        # 🧹 Remove spaces and dashes
        card = re.sub(r'[\s\-]', '', card_number)
        
        # ✅ Check if all digits
        if not card.isdigit():
            raise ValueError("Card number must contain only digits")
        
        # 📏 Check length (simplified)
        if len(card) not in [15, 16]:  # Amex or others
            raise ValueError("Invalid card number length")
        
        # 🔐 Luhn algorithm check
        if not self._luhn_check(card):
            raise ValueError("Invalid card number")
        
        # 🎭 Mask for security (show only last 4)
        return f"****-****-****-{card[-4:]}"
    
    def _luhn_check(self, card_number: str) -> bool:
        """🔍 Luhn algorithm for card validation"""
        def digits_of(n):
            return [int(d) for d in str(n)]
        
        digits = digits_of(card_number)
        odd_digits = digits[-1::-2]
        even_digits = digits[-2::-2]
        checksum = sum(odd_digits)
        for d in even_digits:
            checksum += sum(digits_of(d*2))
        return checksum % 10 == 0
    
    def validate_order(self, order_data: Dict) -> Dict:
        """🛒 Validate complete order"""
        validated = {}
        self.errors = []
        
        # 🎯 Validate each field
        try:
            validated['product'] = self.validate_product_name(
                order_data.get('product', '')
            )
        except ValueError as e:
            self.errors.append(f"Product: {e}")
        
        try:
            validated['quantity'] = self.validate_quantity(
                order_data.get('quantity', '')
            )
        except ValueError as e:
            self.errors.append(f"Quantity: {e}")
        
        try:
            validated['price'] = self.validate_price(
                order_data.get('price', '')
            )
        except ValueError as e:
            self.errors.append(f"Price: {e}")
        
        if self.errors:
            raise ValueError(f"Validation failed: {'; '.join(self.errors)}")
        
        return validated

# 🎮 Let's use it!
validator = OrderValidator()

# ✅ Valid order
try:
    order = validator.validate_order({
        'product': 'Python Book 📘',
        'quantity': '2',
        'price': '29.99'
    })
    print("✅ Order validated:", order)
except ValueError as e:
    print(f"❌ Validation error: {e}")

# ❌ Invalid order
try:
    order = validator.validate_order({
        'product': '<script>alert("hack")</script>',
        'quantity': '-5',
        'price': 'free'
    })
except ValueError as e:
    print(f"❌ Validation error: {e}")

🎯 Try it yourself: Add validation for shipping address and email!

🎮 Example 2: User Registration System

Let’s make a secure user registration validator:

import re
import hashlib
from typing import Dict

class UserRegistrationValidator:
    """👤 Secure user registration validation"""
    
    # 🚫 Common weak passwords
    WEAK_PASSWORDS = [
        'password', '123456', 'password123', 'admin',
        'letmein', 'welcome', 'monkey', '1234567890'
    ]
    
    def validate_username(self, username: str) -> str:
        """🏷️ Validate username"""
        username = username.strip().lower()
        
        # 📏 Length check
        if len(username) < 3:
            raise ValueError("Username too short (min 3 chars)")
        if len(username) > 20:
            raise ValueError("Username too long (max 20 chars)")
        
        # 🔤 Character check
        if not re.match(r'^[a-z0-9_]+$', username):
            raise ValueError("Username can only contain letters, numbers, and underscores")
        
        # 🚫 Reserved names
        reserved = ['admin', 'root', 'system', 'guest']
        if username in reserved:
            raise ValueError("Username is reserved")
        
        return username
    
    def validate_password(self, password: str) -> str:
        """🔐 Validate password strength"""
        # 📏 Length check
        if len(password) < 8:
            raise ValueError("Password too short (min 8 chars)")
        
        # 💪 Strength requirements
        checks = {
            'uppercase': r'[A-Z]',
            'lowercase': r'[a-z]',
            'digit': r'\d',
            'special': r'[!@#$%^&*(),.?":{}|<>]'
        }
        
        missing = []
        for check_name, pattern in checks.items():
            if not re.search(pattern, password):
                missing.append(check_name)
        
        if missing:
            raise ValueError(f"Password must contain: {', '.join(missing)}")
        
        # 🚫 Check common passwords
        if password.lower() in self.WEAK_PASSWORDS:
            raise ValueError("Password is too common")
        
        # ✅ Return hashed password (never store plain text!)
        return self._hash_password(password)
    
    def _hash_password(self, password: str) -> str:
        """🔒 Hash password securely"""
        # 🎲 In production, use bcrypt or argon2!
        return hashlib.sha256(password.encode()).hexdigest()
    
    def validate_age(self, age: str) -> int:
        """🎂 Validate user age"""
        try:
            age_int = int(age)
            if age_int < 13:
                raise ValueError("Must be 13 or older to register")
            if age_int > 120:
                raise ValueError("Invalid age")
            return age_int
        except ValueError:
            raise ValueError("Invalid age format")
    
    def validate_security_question(self, question: str, answer: str) -> Dict[str, str]:
        """🔑 Validate security Q&A"""
        # 🧹 Clean inputs
        question = question.strip()
        answer = answer.strip()
        
        if len(question) < 10:
            raise ValueError("Security question too short")
        if len(answer) < 3:
            raise ValueError("Security answer too short")
        
        # 🛡️ Check for sensitive info in answer
        sensitive_patterns = [
            r'\b\d{3}-\d{2}-\d{4}\b',  # SSN
            r'\b\d{16}\b',  # Credit card
            r'password',  # Literal password
        ]
        
        for pattern in sensitive_patterns:
            if re.search(pattern, answer, re.IGNORECASE):
                raise ValueError("Security answer contains sensitive information")
        
        return {
            'question': question,
            'answer': self._hash_password(answer)  # Hash the answer too!
        }

# 🎮 Test the validator
validator = UserRegistrationValidator()

# ✅ Good registration
try:
    user_data = {
        'username': validator.validate_username('python_dev'),
        'password': validator.validate_password('Secure#Pass123'),
        'age': validator.validate_age('25'),
        'security': validator.validate_security_question(
            "What's your pet's name?",
            "Fluffy"
        )
    }
    print("✅ Registration valid! 🎉")
except ValueError as e:
    print(f"❌ Registration error: {e}")

# ❌ Bad registration attempts
bad_attempts = [
    {'username': 'a'},  # Too short
    {'password': '12345'},  # Too weak
    {'username': '<script>alert("xss")</script>'},  # Invalid chars
]

for attempt in bad_attempts:
    try:
        if 'username' in attempt:
            validator.validate_username(attempt['username'])
        if 'password' in attempt:
            validator.validate_password(attempt['password'])
    except ValueError as e:
        print(f"❌ Caught: {e}")

🚀 Advanced Concepts

🧙‍♂️ Advanced Topic 1: Custom Validation Decorators

When you’re ready to level up, try validation decorators:

from functools import wraps
from typing import Callable, Any

def validate_input(**validators):
    """🎯 Decorator for input validation"""
    def decorator(func: Callable) -> Callable:
        @wraps(func)
        def wrapper(*args, **kwargs):
            # 🔍 Get function arguments
            import inspect
            sig = inspect.signature(func)
            bound = sig.bind(*args, **kwargs)
            bound.apply_defaults()
            
            # ✅ Validate each argument
            for param_name, validator in validators.items():
                if param_name in bound.arguments:
                    try:
                        validated = validator(bound.arguments[param_name])
                        bound.arguments[param_name] = validated
                    except ValueError as e:
                        raise ValueError(f"{param_name}: {e}")
            
            return func(**bound.arguments)
        return wrapper
    return decorator

# 🎨 Create reusable validators
def positive_int(value: Any) -> int:
    """🔢 Validate positive integer"""
    num = int(value)
    if num <= 0:
        raise ValueError("Must be positive")
    return num

def non_empty_string(value: Any) -> str:
    """📝 Validate non-empty string"""
    text = str(value).strip()
    if not text:
        raise ValueError("Cannot be empty")
    return text

# 🚀 Use the decorator!
@validate_input(
    name=non_empty_string,
    age=positive_int
)
def create_user(name: str, age: int) -> Dict:
    """👤 Create user with validation"""
    return {
        'name': name,
        'age': age,
        'created': True
    }

# 🎮 Test it
try:
    user = create_user("Alice", "25")
    print("✅ User created:", user)
    
    user = create_user("", "-5")  # Will fail!
except ValueError as e:
    print(f"❌ Validation failed: {e}")

🏗️ Advanced Topic 2: Schema-Based Validation

For complex data structures, use schema validation:

from typing import Dict, Any, List
import json

class Schema:
    """🏗️ Schema-based validation"""
    
    def __init__(self, schema: Dict[str, Any]):
        self.schema = schema
    
    def validate(self, data: Dict[str, Any]) -> Dict[str, Any]:
        """✅ Validate data against schema"""
        validated = {}
        errors = []
        
        for field, rules in self.schema.items():
            # 🔍 Check required fields
            if rules.get('required', False) and field not in data:
                errors.append(f"{field}: Required field missing")
                continue
            
            if field in data:
                value = data[field]
                
                # 🎯 Type validation
                expected_type = rules.get('type')
                if expected_type and not isinstance(value, expected_type):
                    errors.append(f"{field}: Expected {expected_type.__name__}")
                    continue
                
                # 📏 Length validation
                if 'min_length' in rules and len(value) < rules['min_length']:
                    errors.append(f"{field}: Too short (min {rules['min_length']})")
                
                if 'max_length' in rules and len(value) > rules['max_length']:
                    errors.append(f"{field}: Too long (max {rules['max_length']})")
                
                # 🔢 Range validation
                if 'min_value' in rules and value < rules['min_value']:
                    errors.append(f"{field}: Below minimum ({rules['min_value']})")
                
                if 'max_value' in rules and value > rules['max_value']:
                    errors.append(f"{field}: Above maximum ({rules['max_value']})")
                
                # 🎨 Pattern validation
                if 'pattern' in rules:
                    import re
                    if not re.match(rules['pattern'], str(value)):
                        errors.append(f"{field}: Invalid format")
                
                # 📋 Enum validation
                if 'enum' in rules and value not in rules['enum']:
                    errors.append(f"{field}: Must be one of {rules['enum']}")
                
                # ✅ Custom validator
                if 'validator' in rules:
                    try:
                        value = rules['validator'](value)
                    except ValueError as e:
                        errors.append(f"{field}: {e}")
                        continue
                
                validated[field] = value
        
        if errors:
            raise ValueError(f"Validation errors: {'; '.join(errors)}")
        
        return validated

# 🎮 Define a complex schema
user_schema = Schema({
    'username': {
        'type': str,
        'required': True,
        'min_length': 3,
        'max_length': 20,
        'pattern': r'^[a-zA-Z0-9_]+$'
    },
    'email': {
        'type': str,
        'required': True,
        'pattern': r'^[^\s@]+@[^\s@]+\.[^\s@]+$'
    },
    'age': {
        'type': int,
        'required': True,
        'min_value': 0,
        'max_value': 150
    },
    'role': {
        'type': str,
        'enum': ['user', 'admin', 'moderator'],
        'required': False
    },
    'bio': {
        'type': str,
        'max_length': 500,
        'required': False
    }
})

# 🚀 Validate complex data
try:
    valid_user = user_schema.validate({
        'username': 'python_master',
        'email': '[email protected]',
        'age': 28,
        'role': 'admin',
        'bio': 'I love Python! 🐍'
    })
    print("✅ Valid user data:", valid_user)
except ValueError as e:
    print(f"❌ Schema validation failed: {e}")

⚠️ Common Pitfalls and Solutions

😱 Pitfall 1: Trusting Client-Side Validation

# ❌ Wrong way - relying only on frontend validation
def process_payment(amount):
    # 💥 No server-side validation!
    charge_credit_card(amount)

# ✅ Correct way - always validate server-side!
def process_payment(amount):
    # 🛡️ Validate on server
    try:
        amount_decimal = Decimal(str(amount))
        if amount_decimal <= 0 or amount_decimal > 10000:
            raise ValueError("Invalid amount")
        
        # ✅ Safe to process
        charge_credit_card(amount_decimal)
    except (ValueError, TypeError):
        raise ValueError("Invalid payment amount")

🤯 Pitfall 2: SQL Injection Through Poor Validation

# ❌ Dangerous - string concatenation with user input
def get_user(username):
    query = f"SELECT * FROM users WHERE username = '{username}'"
    # 💥 SQL injection vulnerability!
    return execute_query(query)

# ✅ Safe - parameterized queries + validation
def get_user(username):
    # 🛡️ Validate first
    if not re.match(r'^[a-zA-Z0-9_]+$', username):
        raise ValueError("Invalid username")
    
    # ✅ Then use parameterized query
    query = "SELECT * FROM users WHERE username = ?"
    return execute_query(query, (username,))

💣 Pitfall 3: Incomplete Sanitization

# ❌ Incomplete - only checks for <script>
def sanitize_html(text):
    return text.replace('<script>', '').replace('</script>', '')

# ✅ Complete - proper HTML escaping
import html

def sanitize_html(text):
    # 🛡️ Escape all HTML entities
    return html.escape(text)

# 🎯 Or use a proper library
from markupsafe import Markup, escape

def safe_display(user_input):
    # ✨ Automatically escapes dangerous content
    return Markup('<p>{}</p>').format(escape(user_input))

🛠️ Best Practices

1. 🎯 Validate Early and Often: Check input at every entry point
2. 📝 Whitelist Over Blacklist: Define what’s allowed, not what’s forbidden
3. 🛡️ Defense in Depth: Multiple layers of validation
4. 🎨 Clear Error Messages: Help users fix their input
5. ✨ Sanitize for Context: Different rules for HTML, SQL, URLs, etc.
6. 🔒 Never Trust User Input: Always assume input is malicious
7. 📊 Log Validation Failures: Monitor for attack patterns

🧪 Hands-On Exercise

🎯 Challenge: Build a Secure API Input Validator

Create a comprehensive API input validation system:

📋 Requirements:

• ✅ Validate JSON request bodies
• 🏷️ Support nested object validation
• 👤 Rate limiting per user
• 📅 Timestamp validation
• 🎨 Custom error responses
• 🔐 API key validation
• 📊 Validation metrics logging

🚀 Bonus Points:

• Add request size limits
• Implement field-level encryption markers
• Create reusable validation middleware

💡 Solution

import json
import time
import hashlib
from datetime import datetime, timedelta
from typing import Dict, Any, Optional
from functools import wraps

class APIValidator:
    """🔐 Comprehensive API input validation"""
    
    def __init__(self):
        self.rate_limits: Dict[str, list] = {}
        self.api_keys = {
            'test_key_123': 'test_user',
            'prod_key_456': 'prod_user'
        }
        self.validation_metrics = {
            'total_requests': 0,
            'failed_validations': 0,
            'rate_limit_hits': 0
        }
    
    def validate_api_key(self, api_key: str) -> str:
        """🔑 Validate API key"""
        if not api_key:
            raise ValueError("API key required")
        
        user = self.api_keys.get(api_key)
        if not user:
            self.validation_metrics['failed_validations'] += 1
            raise ValueError("Invalid API key")
        
        return user
    
    def check_rate_limit(self, user: str, limit: int = 10, window: int = 60) -> None:
        """⏱️ Check rate limiting"""
        now = time.time()
        
        # 🧹 Clean old entries
        if user in self.rate_limits:
            self.rate_limits[user] = [
                t for t in self.rate_limits[user] 
                if now - t < window
            ]
        else:
            self.rate_limits[user] = []
        
        # 🚦 Check limit
        if len(self.rate_limits[user]) >= limit:
            self.validation_metrics['rate_limit_hits'] += 1
            raise ValueError(f"Rate limit exceeded ({limit} requests per {window}s)")
        
        self.rate_limits[user].append(now)
    
    def validate_timestamp(self, timestamp: str, max_age_minutes: int = 5) -> datetime:
        """🕐 Validate timestamp freshness"""
        try:
            # 📅 Parse ISO format
            ts = datetime.fromisoformat(timestamp.replace('Z', '+00:00'))
            
            # ⏰ Check if too old
            age = datetime.now() - ts
            if age > timedelta(minutes=max_age_minutes):
                raise ValueError("Request timestamp too old")
            
            # 🔮 Check if in future
            if ts > datetime.now() + timedelta(minutes=1):
                raise ValueError("Request timestamp in future")
            
            return ts
        except:
            raise ValueError("Invalid timestamp format")
    
    def validate_request_size(self, data: Any, max_size_kb: int = 1024) -> None:
        """📏 Validate request size"""
        size = len(json.dumps(data).encode('utf-8'))
        if size > max_size_kb * 1024:
            raise ValueError(f"Request too large ({size} bytes)")
    
    def validate_nested_object(self, data: Dict, schema: Dict) -> Dict:
        """🏗️ Validate nested objects"""
        validated = {}
        
        for field, rules in schema.items():
            if field not in data and rules.get('required', False):
                raise ValueError(f"Missing required field: {field}")
            
            if field in data:
                value = data[field]
                
                # 🎯 Nested object validation
                if 'object_schema' in rules:
                    validated[field] = self.validate_nested_object(
                        value, rules['object_schema']
                    )
                elif 'array_schema' in rules:
                    validated[field] = [
                        self.validate_nested_object(item, rules['array_schema'])
                        for item in value
                    ]
                else:
                    # 📝 Simple field validation
                    validated[field] = self._validate_field(field, value, rules)
        
        return validated
    
    def _validate_field(self, name: str, value: Any, rules: Dict) -> Any:
        """🔍 Validate individual field"""
        # Type check
        if 'type' in rules and not isinstance(value, rules['type']):
            raise ValueError(f"{name}: Invalid type")
        
        # String validations
        if isinstance(value, str):
            if 'max_length' in rules and len(value) > rules['max_length']:
                raise ValueError(f"{name}: Too long")
            if 'pattern' in rules:
                import re
                if not re.match(rules['pattern'], value):
                    raise ValueError(f"{name}: Invalid format")
        
        return value
    
    def validate_api_request(self, request: Dict) -> Dict:
        """🚀 Complete API request validation"""
        self.validation_metrics['total_requests'] += 1
        
        try:
            # 🔑 Validate API key
            user = self.validate_api_key(request.get('api_key', ''))
            
            # ⏱️ Check rate limit
            self.check_rate_limit(user)
            
            # 🕐 Validate timestamp
            self.validate_timestamp(request.get('timestamp', ''))
            
            # 📏 Check request size
            self.validate_request_size(request)
            
            # 🏗️ Validate request body
            body_schema = {
                'action': {
                    'type': str,
                    'required': True,
                    'pattern': r'^[a-z_]+$'
                },
                'data': {
                    'type': dict,
                    'required': True,
                    'object_schema': {
                        'user_id': {
                            'type': str,
                            'required': True,
                            'pattern': r'^[a-zA-Z0-9-]+$'
                        },
                        'amount': {
                            'type': (int, float),
                            'required': False
                        }
                    }
                }
            }
            
            validated_body = self.validate_nested_object(
                request.get('body', {}), 
                body_schema
            )
            
            return {
                'user': user,
                'body': validated_body,
                'validated_at': datetime.now().isoformat()
            }
            
        except ValueError as e:
            self.validation_metrics['failed_validations'] += 1
            raise

# 🎮 Test the API validator
validator = APIValidator()

# ✅ Valid request
valid_request = {
    'api_key': 'test_key_123',
    'timestamp': datetime.now().isoformat(),
    'body': {
        'action': 'create_order',
        'data': {
            'user_id': 'user-123',
            'amount': 99.99
        }
    }
}

try:
    result = validator.validate_api_request(valid_request)
    print("✅ Request validated:", result)
except ValueError as e:
    print(f"❌ Validation failed: {e}")

# 📊 Check metrics
print("\n📊 Validation Metrics:")
for metric, value in validator.validation_metrics.items():
    print(f"  {metric}: {value}")

# 🛡️ Middleware decorator
def validate_api(validator: APIValidator):
    """🎯 API validation decorator"""
    def decorator(func):
        @wraps(func)
        def wrapper(request: Dict):
            try:
                validated = validator.validate_api_request(request)
                return func(validated)
            except ValueError as e:
                return {
                    'error': str(e),
                    'status': 'validation_failed'
                }
        return wrapper
    return decorator

# 🚀 Use the decorator
@validate_api(validator)
def process_order(validated_request: Dict) -> Dict:
    """💰 Process validated order"""
    return {
        'status': 'success',
        'order_id': 'ORD-' + str(time.time()),
        'user': validated_request['user']
    }

# Test the decorated function
result = process_order(valid_request)
print("\n🎯 Decorated function result:", result)

🎓 Key Takeaways

You’ve learned essential security skills! Here’s what you can now do:

• ✅ Implement comprehensive input validation with confidence 💪
• ✅ Prevent common security vulnerabilities like injection attacks 🛡️
• ✅ Build robust validation systems for any application 🎯
• ✅ Create reusable validation components like a pro 🐛
• ✅ Secure your Python applications against malicious input! 🚀

Remember: Input validation is your first line of defense. Never trust user input, always validate! 🤝

🤝 Next Steps

Congratulations! 🎉 You’ve mastered input validation security!

Here’s what to do next:

1. 💻 Practice with the exercises above
2. 🏗️ Implement validation in your existing projects
3. 📚 Learn about output encoding and CSRF protection
4. 🌟 Share your secure coding practices with others!

Remember: Security is not a feature, it’s a requirement. Keep your applications safe, and most importantly, keep learning! 🚀

Happy secure coding! 🔒🎉✨