What Is Input Validation? The #1 Rule of Web Security

Why "Never Trust User Input" Is Rule #1

Every field a user can type into, every URL parameter, every API request body is an attack surface. Without validation, a user can submit:

• SQL commands in a name field → SQL injection
• JavaScript in a comment → Cross-site scripting (XSS)
• A 500MB string in an email field → denial of service
• A negative number in a price field → free products
• An admin role value in a hidden form field → privilege escalation

Input validation is the single most impactful security practice. It stops most attacks at the front door.

Real Scenario: A User Registration API

What AI Generated (Zod + Express)

// Tested with Zod 3.x + Express 4.x + Node.js 22.x
import { z } from 'zod'

// Define the validation schema — what valid registration data looks like
const registerSchema = z.object({
  email: z
    .string()
    .email('Invalid email address')
    .max(255, 'Email too long')
    .transform(val => val.toLowerCase().trim()),

  name: z
    .string()
    .min(1, 'Name is required')
    .max(100, 'Name must be under 100 characters')
    .regex(/^[a-zA-Z\s'-]+$/, 'Name contains invalid characters'),

  password: z
    .string()
    .min(8, 'Password must be at least 8 characters')
    .max(128, 'Password too long')
})

// The API endpoint
app.post('/api/register', async (req, res) => {
  // Parse and validate — throws if invalid
  const result = registerSchema.safeParse(req.body)

  if (!result.success) {
    // Return specific errors for each field
    return res.status(400).json({
      errors: result.error.issues.map(issue => ({
        field: issue.path.join('.'),
        message: issue.message
      }))
    })
  }

  // result.data is validated AND transformed (email lowered/trimmed)
  const { email, name, password } = result.data

  // Now safe to use — hash password, save to DB, etc.
  const hashedPassword = await bcrypt.hash(password, 12)
  // ...
})

Client-Side vs. Server-Side Validation

The rule: Client-side validation is a UX feature. Server-side validation is a security feature. Always do both, but never rely on client-side alone.

How Easy Is It to Bypass Client-Side Validation?

# This bypasses ALL client-side validation:
curl -X POST https://yourapp.com/api/register \
  -H "Content-Type: application/json" \
  -d '{"email": "not-an-email", "name": "<script>alert(1)</script>", "password": "x"}'

# No browser involved. No JavaScript ran. No HTML 'required' checked.
# If your server doesn't validate, this malicious data goes straight to your database.

Validation vs. Sanitization

Validation: "Does this data match what I expect?" Reject if no.

Sanitization: "Clean this data so it's safe to use." Transform it.

// VALIDATION: reject bad data
if (!email.includes('@')) throw new Error('Invalid email')
if (name.length > 100) throw new Error('Name too long')

// SANITIZATION: clean data that passed validation
const cleanName = name.trim()                    // Remove extra whitespace
const cleanEmail = email.toLowerCase().trim()    // Normalize
const safeHtml = DOMPurify.sanitize(userContent) // Strip dangerous HTML

// Best practice: validate first, then sanitize what passes

What AI Gets Wrong

1. Client-Side Only Validation

// AI generates this for a form:
<input type="email" required minlength="5">

// This is UX — NOT security. The server must also validate.
// Ask AI: "Add server-side validation for this endpoint using Zod"

2. No Length Limits

// AI validates format but not size:
const schema = z.object({
  bio: z.string()  // No max length — user can send 10MB of text!
})

// Fix: always set max length
const schema = z.object({
  bio: z.string().max(5000, 'Bio must be under 5000 characters')
})

3. Trusting Hidden Form Fields

// AI sometimes generates:
<input type="hidden" name="role" value="user">

// An attacker changes this to:
<input type="hidden" name="role" value="admin">

// Server-side: NEVER trust role/permission values from the client.
// Determine the user's role from their authenticated session, not from the request body.

What to Learn Next

Frequently Asked Questions