Why does input validation matter for security?

Input validation means checking that incoming data is the shape, type and range you expect, and rejecting it when it is not. It matters because every injection vulnerability starts with data that was trusted when it should not have been.

Validate on the server, always

Client-side checks exist for user experience — instant feedback, fewer wasted requests. They are not a security control: anyone can bypass the form and call your API directly with curl. Treat every request as if it came from an attacker, because one of them will.

// server side
if (typeof body.email !== "string" || !/^[^@\s]+@[^@\s]+$/.test(body.email)) {
  return res.status(400).json({ error: "Invalid email" });
}

Allowlist, not denylist

Define what is acceptable and reject everything else. Trying to enumerate bad input fails because attackers have more variations than you have patience — encodings, unicode look-alikes, nesting. "Must be one of these five values" is defensible; "must not contain <script>" is not.

Validation is not the whole defence

It reduces the attack surface but does not make data safe to use anywhere. Each destination needs its own protection:

• SQL — parameterised queries, never string concatenation.
• HTML — escape on output, or let your framework do it; React escapes by default and dangerouslySetInnerHTML opts out.
• Shell commands — avoid them; if unavoidable, pass arguments as an array, never build a command string.
• File paths — resolve and confirm the result stays inside the intended directory.

Practical advice

Use a schema library such as Zod or Valibot to declare the expected shape once and derive both validation and types from it. Check length limits too — an unbounded field is a denial-of-service vector. And return generic error messages: detailed validation errors can leak your data model.