What are the key questions and problems when implementing input validation?

Three questions — which data, where, and when do you validate? Four problems that make it hard — sheer amount of data, efficiency cost, attackers bypassing the check, and streaming data you can't see whole.

The questions force you to scope the work; the problems explain why "just validate everything" is harder than it sounds:

• Amount — real systems have countless input points; missing one is enough.
• Efficiency — validation runs on every request, so it must be cheap or it becomes the bottleneck (or a DoS lever).
• Bypassing — attackers route around outer checks (encoding tricks, hitting internal interfaces directly), which is why you validate at every boundary, not just the front door.
• Streaming — with continuous data you may have to decide on a chunk before the full message has arrived, so you can't always see the whole input to judge it.

Questions to answer:

Implementation problems:

Key insight: Input validation is necessary but challenging to implement correctly and completely. The defender must validate ALL input at ALL interfaces ALL the time — the attacker only needs to find ONE gap.