Limitations of Validation

Validation checks that input follows a set of rules before a program accepts it. Passing validation only means the value fits those rules. It cannot prove that the value is true or accurate.

A valid value is not always a true value

Imagine a leisure centre booking system that asks for a membership number. The validation rule checks that the number is exactly six digits. The input 004821 passes the rule, but it could still be a mistyped version of a real membership number, or it could be another member's number. The rule checks the shape of the data, not who it belongs to or whether it is correct.

Rules that are too strict

Validation rules can also reject genuine data. If the leisure centre later issues seven-digit membership numbers, the six-digit rule would refuse a valid new number. The rule was designed around old data, so it no longer matches the real data being accepted. Rules must be based on the values that genuinely occur, including any new formats.

Validation can stop unsuitable input, but it is not a guarantee of correctness. It cannot prevent every crash or security problem, because it only compares input with the programmed rules. Data that passes can still be wrong, so validation is one safeguard rather than a complete solution.