input-validation

Define Pydantic BaseModel schemas with Field constraints for type, length, pattern, and range, then use field_validator decorators for custom business rules. FastAPI automatically rejects invalid requests with 422 errors before they reach your route handlers.

Always use parameterized queries like db.execute("SELECT * FROM users WHERE id = %s", (user_id,)) instead of string interpolation. For dynamic column names that cannot be parameterized, validate against an allowlist of permitted values before building the query.

Reject invalid input for security-critical fields like emails and IDs rather than trying to fix them. Sanitization with tools like bleach is appropriate only for free-text content where you want to strip dangerous HTML while preserving safe formatting.

Check file size while streaming in chunks, verify the actual MIME type using magic bytes via python-magic rather than trusting the Content-Type header, and confirm the extension matches the detected content type. Never rely on client-supplied metadata alone.

Allowlist validation defines exactly what input is valid and rejects everything else, so novel attack payloads are blocked by default. Denylists only block known-bad patterns and consistently fail against new obfuscation techniques and encoding tricks.

Use pytest with parametrize to run OWASP test vectors including SQL injection strings, XSS payloads, and path traversal sequences against your endpoints. Assert that malicious inputs return 400 or 422 status codes and that accepted content has dangerous tags stripped.