title: How to sanitize and validate user input to pass a Checkmarx scan
body: <p>I have an endpoint that receives a String from the client as seen below: </p>
  
  <pre><code>@GET
  @Path("/{x}")
  public Response doSomething(@PathParam("x") String x) {
      String y = myService.process(x);
      return Response.status(OK).entity(y).build();
  }
  </code></pre>
  
  <p>Checkmarx complains that this element’s value then <em>"flows through the code without being properly sanitized or validated and is eventually displayed to the user in method doSomething"</em></p>
  
  <p>Then I tried this:</p>
  
  <pre><code>@GET
  @Path("/{x}")
  public Response doSomething(@PathParam("x") String x) {
      if (StringUtils.trimToNull(x) == null || x.length() &gt; 100) { 
          throw new RuntimeException(); 
      }
      x = x.replace("'", "").replace("`", "").replace("\\", "").replace("\"", "")
      String y = myService.process(x);
      y = y.replace("'", "").replace("`", "").replace("\\", "").replace("\"", "")
      return Response.status(OK).entity(y).build();
  }
  </code></pre>
  
  <p>But it still considers this a high severity vulnerability.</p>
  
  <p>How do I properly sanitize or validate to pass a Checkmarx scan?</p>