Most software testers know how to conduct boundary testing: for example, if the tester knows that a text field should only accept 20 characters, they will test with 19 characters, 20 characters, and 21 characters, and perhaps even 100 characters. But I have often encountered situations where a tester does not think to do boundary testing if no boundary is specified in the acceptance criteria. This is dangerous!
There are many reasons to know the limits of your input fields and of your application. Not knowing can mean that your application is vulnerable to attack, or that the user experience will be degraded. In this post, I’ll discuss three types of limits you’ll want to know and test for.

Size Limits:
Whenever you encounter an input field in your application, you should test to discover what the limits are. What is the lowest input you can enter? What is the highest? For example, if the field is expecting a numeric value, find out what the highest value is that the field will accept. Then find out what the lowest field is. Will it be zero? Will the field accept negative numbers? For text fields, discover whether the field will accept a single character, and find out how many characters you can add before the submission fails.
There are two reasons why you should always do this: first, you want to make sure that the user receives an appropriate error message if they exceed (or go lower than) the limit. Imagine a scenario where someone with a last name with more than twenty characters tries to enter their name into a field that will only accept twenty characters. If they don’t get an error message telling them why their submission failed, they will be very frustrated and have a poor user experience.
Secondly, a field without appropriate limits is vulnerable to a buffer overflow attack. This is where a malicious user floods the text field with hundreds or thousands of characters in the hope that it will trigger a server error that will provide them with information that they can use to reach the database. You’ll want to make sure that there are input limits in place to prevent this kind of vulnerability.
Size limits are also important with file uploads. What is the maximum file size that your application will accommodate? Not knowing this can result in users seeing their upload fail without knowing why, or malicious users crippling the application by uploading files your software can’t handle.
Type Limits:
Whenever a file can be uploaded to an application, you’ll want to discover exactly which file types are allowed and which are prohibited. Again, one reason for this is that you’ll want to make sure that the user receives an appropriate error message if they try to upload a file type that is not allowed. You’ll also want to validate that all allowed file types can be processed properly. It won’t matter if your application says that it allows .png files if the application doesn’t actually process them! Finally, it’s important to make sure that the application is not vulnerable to malicious file uploads. If a malicious user can upload a file with embedded code, you are opening up your application to attack.
When you are testing file types, don’t believe the file extension. A hacker could disguise an .exe file as a .txt file to try to bypass the file upload checks. You’ll want to make sure that there is file-checking software in place that validates that the file is actually what it says it is.
Performance Limits:
A third kind of limit you should know about is the performance limit. You should know how many requests your application can handle per second before performance is degraded, and you should also know what the user will experience when the performance is degraded. To gain this information, you’ll want to conduct load and stress testing. Find out how many users your application is expected to support; then run load tests with that number of simulated users to confirm that the application works as expected. Next, increase the number of simulated users gradually until the response time slows or the requests start backing up. Make note of what your real users will experience if this happens: will they get an error message? Will the application freeze or crash? Or will they be staring at a progress wheel for several minutes? Once you have this information, you can bring it back to your team and discuss any needed changes.
The great benefit of software testers is that they are always thinking about what could possibly go wrong with an application. Be sure to know your limits in every area of your software!