Using unvalidated values can expose an application to injection attacks. 


== Noncompliant Code Example

----
public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
  // ...
  Employee employee = new Employee();
  employee.setFirstName(request.getParameter("firstName")); // Noncompliant
  // ...

  save(employee); // Uh-oh!
----


== See

* https://www.owasp.org/index.php/Top_10-2017_A1-Injection[OWASP Top 10 2017 Category A1] - Injection
* https://wiki.sei.cmu.edu/confluence/x/7jdGBQ[CERT, IDS51-J.] - Properly encode or escape output
* https://wiki.sei.cmu.edu/confluence/x/FDZGBQ[CERT, IDS52-J.] - Prevent code injection

