🛡️ Request Validation and Sanitization

Why Never Trust Input

Your API is a public door. Anyone can knock — a legitimate frontend, a curious developer with curl, an automated scanner, or an attacker. The request body, query string, URL params, and headers are all attacker-controllable. Treating any of them as trustworthy is how applications get breached, corrupted, or crashed.

💡 Rule of thumb: "Never trust user input. Never. Not even if your user is another one of your own systems." A request that came from your React app today can be replayed with tampered data tomorrow.

Validating requests at the edge pays off in four ways:

• Security — stop injection, XSS, and malformed payloads before they do damage.
• Data integrity — keep garbage out of your database so the rest of the app can trust it.
• Better UX — return precise, per-field errors the frontend can display.
• Simpler code — downstream logic works with clean, predictable shapes instead of defensive checks everywhere.

Validation vs Sanitization

These two words are often used interchangeably, but they do different jobs — and a robust endpoint uses both.

What you typically check falls into three layers, from cheap to expensive:

Manual Validation

The simplest approach is hand-written checks in the handler. It's worth seeing, because it makes the pain that libraries solve obvious.

app.post('/api/products', (req, res) => {
  const { name, price, categoryId } = req.body;
  const errors = [];

  if (!name || typeof name !== 'string') {
    errors.push('name is required and must be a string');
  } else if (name.length < 3 || name.length > 100) {
    errors.push('name must be between 3 and 100 characters');
  }

  if (typeof price !== 'number' || price <= 0) {
    errors.push('price must be a positive number');
  }

  if (!categoryId) {
    errors.push('categoryId is required');
  }

  if (errors.length > 0) {
    return res.status(400).json({ errors });
  }

  // ...only now is it safe to use the data
});

Using express-validator

express-validator wraps the battle-tested validator.js library as Express middleware. You describe each field with a fluent validation chain, and it collects the errors for you.

npm install express-validator

const express = require('express');
const { body, validationResult } = require('express-validator');

const app = express();
app.use(express.json());

app.post(
  '/api/products',
  [
    body('name')
      .isString().withMessage('name must be a string')
      .trim()
      .isLength({ min: 3, max: 100 }).withMessage('name must be 3–100 chars'),
    body('price')
      .isFloat({ gt: 0 }).withMessage('price must be greater than 0'),
    body('categoryId')
      .notEmpty().withMessage('categoryId is required'),
  ],
  (req, res) => {
    const errors = validationResult(req);
    if (!errors.isEmpty()) {
      return res.status(400).json({ errors: errors.array() });
    }
    // req.body is now validated (and trimmed)
    res.status(201).json({ data: req.body });
  }
);

A validation chain reads top-to-bottom: each call adds a rule, and .withMessage() customizes the error for the rule right before it. Common validators:

Custom & async validators

Business rules that need the database go in custom(). Throwing an error (or returning a rejected promise) marks the field invalid:

body('username').custom(async (value) => {
  const existing = await User.findOne({ username: value });
  if (existing) {
    throw new Error('Username is already taken');
  }
  return true; // valid
});

A reusable validate() middleware

Checking validationResult in every handler is repetitive. Extract it once and every route stays clean:

// middleware/validate.js
const { validationResult } = require('express-validator');

const validate = (validations) => async (req, res, next) => {
  await Promise.all(validations.map((v) => v.run(req)));

  const errors = validationResult(req);
  if (errors.isEmpty()) return next();

  res.status(400).json({
    status: 'error',
    errors: errors.array().map((e) => ({ field: e.path, message: e.msg })),
  });
};

module.exports = validate;

// routes/product.routes.js
const validate = require('../middleware/validate');
const { body } = require('express-validator');

const productRules = [
  body('name').isString().trim().isLength({ min: 3, max: 100 }),
  body('price').isFloat({ gt: 0 }),
];

router.post('/', validate(productRules), controller.createProduct);
// the controller never has to think about validation again

Schema Validation with Zod

For complex, nested payloads, defining a whole schema is cleaner than chaining rules field by field. Zod is the modern favorite: you declare the shape once, and it both validates and returns the parsed, correctly typed data. (Joi and Yup follow the same idea; Zod is shown here because it's TypeScript-native and widely adopted.)

npm install zod

const { z } = require('zod');

const userSchema = z.object({
  username: z.string().min(3).max(20),
  email: z.string().email(),
  password: z.string().min(8)
    .regex(/[A-Z]/, 'Needs an uppercase letter')
    .regex(/[a-z]/, 'Needs a lowercase letter')
    .regex(/\d/, 'Needs a number'),
  age: z.number().int().min(13).optional(),
});

Wrap it as generic middleware so any route can validate against any schema. On success, parse returns clean data (with defaults applied and unknown keys stripped); on failure it throws a structured error you can format:

// middleware/validateSchema.js
const validateSchema = (schema) => (req, res, next) => {
  const result = schema.safeParse(req.body);
  if (!result.success) {
    return res.status(400).json({
      status: 'error',
      errors: result.error.issues.map((i) => ({
        field: i.path.join('.'),
        message: i.message,
      })),
    });
  }
  req.body = result.data; // parsed & typed
  next();
};

module.exports = validateSchema;

router.post('/register', validateSchema(userSchema), controller.register);

Sanitization & Security

Validation confirms data is acceptable; sanitization makes it safe. express-validator ships sanitizers you chain right alongside validators:

app.post('/api/register', validate([
  body('email').isEmail().withMessage('Invalid email')
    .normalizeEmail().trim(),
  body('name').isString().isLength({ min: 2, max: 50 })
    .trim().escape(),
  // Do NOT trim or escape passwords — it would silently alter them
  body('password').isLength({ min: 8 }),
]), controller.register);

The injection you must always prevent

Injection happens when untrusted input is concatenated into a command — SQL, a shell, or a NoSQL query. The fix is never to build the command from strings, but to pass data as parameters the driver escapes for you.

// ❌ BAD — user input becomes part of the SQL
const q = `SELECT * FROM users WHERE email = '${req.body.email}'`;

// ✅ GOOD — parameterized query; the driver handles escaping
const q = 'SELECT * FROM users WHERE email = ?';
connection.query(q, [req.body.email]);

NoSQL is vulnerable too. A raw { username: req.body.username } lets an attacker send an object like { "$ne": null } as the username. Enforce the type first:

const username =
  typeof req.body.username === 'string' ? req.body.username.trim() : '';
const query = { username }; // now guaranteed to be a plain string

Hands-on Exercise

const express = require('express');
const { body } = require('express-validator');
const validate = require('./middleware/validate');

const app = express();
app.use(express.json());

const registerRules = [
  body('username')
    .isString().trim()
    .isLength({ min: 3, max: 20 }).withMessage('username must be 3–20 chars')
    .matches(/^[A-Za-z0-9_]+$/).withMessage('letters, numbers, underscore only'),
  body('email')
    .isEmail().withMessage('invalid email')
    .normalizeEmail(),
  body('password')
    .isLength({ min: 8 }).withMessage('at least 8 characters')
    .matches(/[A-Z]/).withMessage('needs an uppercase letter')
    .matches(/[a-z]/).withMessage('needs a lowercase letter')
    .matches(/\d/).withMessage('needs a number'),
  body('age')
    .optional()
    .isInt({ min: 13 }).withMessage('must be 13 or older'),
  body('acceptedTerms')
    .equals('true').withMessage('you must accept the terms'),
];

app.post('/api/register', validate(registerRules), (req, res) => {
  // Data is validated & sanitized here
  res.status(201).json({ status: 'success', data: { user: req.body.username } });
});

app.listen(3000, () => console.log('http://localhost:3000'));

Best Practices

Summary & Quiz

📚 Further Reading

• express-validator documentation
• Zod documentation
• OWASP — Input Validation Cheat Sheet

🚀 What's Next?

Now that only clean data gets through, we'll make your API's replies just as disciplined. Next up: response formatting and status codes — consistent envelopes and honest codes for every outcome.