Global Validation

Server-side validation using allowlists and input sanitization blocks injection attacks and malicious data before processing. Implement type checking, format validation, and sanitization rules for all external input to ensure only safe, expected data enters your system.

Enforce consistent validation across all entry points: validate data types, formats, and ranges against business rules; check required fields; and sanitize input to remove harmful characters. Apply the same rules server-side for both API and form requests to guarantee data integrity.

Return standardized, user-facing error messages that explain what failed and why without exposing system details. Consistent error messaging improves user experience and helps users correct invalid input on first attempt.

Server-side validation is mandatory for security; client-side validation enhances user experience but can be bypassed. Always enforce validation on the server to prevent invalid or malicious data from entering your system, regardless of client-side checks.

Input sanitization removes or escapes potentially harmful characters and patterns that could enable injection attacks. Use allowlists to accept only expected characters and formats, and encode or strip dangerous sequences before storing or processing data.

Apply business-rule validation after type and format checks pass to enforce domain-specific constraints: password strength requirements, duplicate prevention, range limits, or conditional logic. This ensures data conforms to application requirements, not just data types.