INPUT-VALIDATION

SQL injection and XSS attacks are prevented through input validation and sanitization. Use schema validation with strong types like Zod to enforce expected data formats, then escape or normalize user inputs before processing. This blocks malicious code from executing in queries or rendered content.

API route input validation uses schema validators like Zod to define strict data contracts. Define a schema matching your expected input structure, validate incoming data against it before business logic runs, and reject requests that fail validation. This prevents malformed or malicious data from reaching your application.

Protection against CSRF and injection threats combines input validation, sanitization, and security headers. Validate all inputs against defined schemas, escape outputs appropriately for context, use secure authentication flows, and apply OWASP Top 10 countermeasures like CSRF tokens and content security policies.

Input validation and secrets management serve different purposes. Environment variables protect sensitive configuration, while input validation guards against malicious or malformed user data. Both are required: use environment variables for secrets and input validation for all user-supplied data across APIs and workflows.

Input sanitization defends against SQL injection, XSS, CSRF, and command injection by normalizing and escaping user inputs before they reach vulnerable code paths. Sanitization removes or neutralizes special characters that could be interpreted as executable code, blocking attackers from injecting malicious payloads.