Which of the following is NOT true of input validation?
A. Server-side input validation is easier to exploit than client-side validation.
B. It is a form of filtering.
C. Unexpected or unwanted input is automatically rejected, and the underlying database remains inaccessible.
D. It is a good first line of defense against injection flaw attacks.