usersupplied

User-supplied data refers to information provided by people interacting with a software system, rather than produced by the system itself. The term is often written as user-supplied or as user input. It includes values entered into forms, parameters supplied via an API, uploaded files, or configuration options chosen by a user. In many systems, user-supplied data drives behavior, content, and access decisions.

User-supplied data appears across many contexts: web forms, command-line interfaces, mobile apps, and configuration dashboards. It can be upfront required data or optional fields, defaults being supplied by the system when users omit input. The reliability and security of software frequently depend on how such data is handled.

There are several risks associated with user-supplied input. It can be malformed, out of range, or spoofed, leading to errors, security vulnerabilities, or data integrity issues. Common threats include injection attacks, cross-site scripting, and path traversal. Correct handling requires treating user input as untrusted until proven otherwise.

Best practices for managing user-supplied data include:

- Validate and sanitize input at boundaries, applying both type- and context-specific checks.

- Escape or encode data when rendering in different contexts (HTML, SQL, shell).

- Prefer parameterized queries and prepared statements to separate data from code.

- Enforce least privilege and input-length constraints, with sensible defaults and error handling.

- Log provenance and validation results to support auditing and debugging.

Considerations also cover privacy and consent, as user-supplied data may include personal information. Systems should minimize data collection, protect sensitive fields, and comply with applicable laws and policies.

Examples include user-entered search terms, profile information, settings chosen in a preferences panel, or data uploaded to a service.

See also: input validation, data integrity, user input, data sanitization.