Null byte injection embeds a NUL character in input so validation treats it as an ordinary string or misses its special meaning. In an API, this can reach storage or downstream processing unexpectedly and, in some cases, enable malicious code injection. section 12.3
A registration payload
A fuzzing test submits {"phone_number":"\u0000"} to a student-registration endpoint. JSON represents the NUL as \u0000; the database error exposes it as \x00. PostgreSQL rejects the value because text fields cannot contain NUL bytes, revealing that validation allowed the disguised null through. section 12.3
Reduce this failure mode by:
- Reject fields containing the \x00 character in data-validation models before they reach storage or business logic. section 12.3
- Use fuzzing and contract testing to generate unexpected values, inspect stack traces, and add targeted tests for API and business-layer behavior. section 12.3
