input-validation

Input Validation

When to Use

• Building or reviewing API endpoints that accept user input
• Working with database queries, HTML rendering, or form handling
• Auditing an existing application for injection vulnerabilities
• Adding validation middleware to a web framework
• Handling file uploads, URL parameters, or header values

Prerequisites

• Understanding of the application's input surfaces (APIs, forms, file uploads)
• Access to the codebase's request handlers and data layer
• A validation library available (zod, joi, express-validator, etc.)

Workflow

1. Map Input Surfaces

Identify everywhere user input enters the application:

# Find route handlers / API endpoints
grep -rn "app\.\(get\|post\|put\|delete\|patch\)\|router\." src/ --include="*.ts"

# Find request body/query/param access
grep -rn "req\.body\|req\.query\|req\.params\|request\.json" src/ --include="*.ts"

# Find file upload handlers
grep -rn "multer\|upload\|formidable\|busboy" src/ --include="*.ts"

1-A. Layer boundary controls before validation

Treat permission and access boundaries as the first control and application-level input validation as the second, independent control. Neither is sufficient alone: restricted credentials reduce blast radius when validation fails, and validation still matters even when the backing system is locked down.

• Use least-privilege roles and restricted credentials (for example, read-only database roles where appropriate)
• Restrict execution to a single statement where feasible
• Prefer allowlists over denylists when validating identifiers, operations, or query shapes
• Apply statement timeouts and max-row-count caps to limit abuse
• Sanitize error messages so they never reveal credentials or connection details

2. SQL Injection Prevention

# Find raw SQL queries — these are high risk
grep -rn "query\s*(\|execute\s*(\|raw\s*(" src/ --include="*.ts" -A 2

// ❌ VULNERABLE — string concatenation
const result = await db.query(`SELECT * FROM users WHERE id = '${userId}'`);

// ✅ SAFE — parameterized query
const result = await db.query('SELECT * FROM users WHERE id = $1', [userId]);

// ✅ SAFE — ORM with built-in parameterization
const user = await User.findOne({ where: { id: userId } });