The present description refers in particular to a computer-implemented method, a computer system, and a computer program product for input validation and output validation to prevent SQL injections. The computer-implemented method may comprise: receiving at a service (122) a request message from a client (110) over a network (130), wherein the service is located on a server; providing a handler (126) at the server; checking the request message at the handler using a first method before sending the request message to the service; and checking a response message at the handler using the first method before sending the response message to the client.