  Improper Input Validation (IIV) is a software vulnerability that occurs when
a system does not safely handle input data. Even though IIV is easy to detect
and fix, it still commonly happens in practice. In this paper, we study to what
extent developers can detect IIV and investigate underlying reasons. This
knowledge is essential to better understand how to support developers in
creating secure software systems. We conduct an online experiment with 146
participants, of which 105 report at least three years of professional software
development experience. Our results show that the existence of a visible attack
scenario facilitates the detection of IIV vulnerabilities and that a
significant portion of developers who did not find the vulnerability initially
could identify it when warned about its existence. Yet, a total of 60
participants could not detect the vulnerability even after the warning. Other
factors, such as the frequency with which the participants perform code
reviews, influence the detection of IIV. Data and materials:
https://doi.org/10.5281/zenodo.3996696
