27. Validating input

Every value coming from a request body, query string or header is untrusted and must be validated before use — wrong types, missing fields and malicious payloads are all normal, expected input from the internet, not edge cases.

js
function validateTransferRequest(body) {
  const errors = [];
  if (typeof body.to !== "string" || !/^0x[0-9a-fA-F]{40}$/.test(body.to)) {
    errors.push("to must be a valid address");
  }
  if (typeof body.amount !== "string" || !/^\d+$/.test(body.amount)) {
    errors.push("amount must be a numeric string");
  }
  return errors;
}

app.post("/transfer", (req, res) => {
  const errors = validateTransferRequest(req.body);
  if (errors.length) return res.status(400).json({ errors });
  // safe to proceed
});

Libraries like Zod or Joi turn this hand-written pattern into declarative schemas, but the underlying principle is the same: validate at the boundary, before any business logic runs.

Read in another language

How to study this topic

Scoring

Check your understanding

Badges