Incorrect Behavior Order: Validate Before Filter

The core issue is a logic flaw in the data handling pipeline. When validation runs before filtering, an attacker can craft input that passes the initial checks but transforms into a malicious payload after filtering. For example, a validator might allow a string containing certain special characters, but a subsequent filter designed to neutralize those same characters might inadvertently create valid attack syntax, like SQL commands or script tags. This flaw effectively bypasses security controls, turning defensive filters into weapons. It exposes the application to injection attacks (like SQLi or XSS) that the validation step was meant to prevent. To fix this, developers must always sanitize or normalize user input first, then validate the cleaned data against security rules. This ensures the data you check is the exact same data your application processes.