In one embodiment, analyze client-tier source code of a client-server software application to extract one or more software modules that handle user-input data of the software application. For each one of the software modules, extract from the software module one or more user-input constraints placed on the user-input data, comprising: analyze source code of the software module to determine one or more failure points in the source code; perform symbolic execution on the software module to extract one or more first expressions that cause the software module to reach the failure points, respectively; obtain a second expression as the disjunction of all the first expressions; obtain a third expression as the negation of the second expression; and extract the user-input constraints from the third expression. Determine one or more user-input data that satisfy all the user-input constraints.