Validating input

Never trust input

Input is any data that comes from outside your server: the body, the query, path params, headers and cookies. Your own app may check the form, but people can send requests with tools like curl or Postman, or change the app. So the backend must check everything again.

Four kinds of checks

Checking formats with regular expressions

A regular expression (regex) is a short pattern that describes the shape of some text. ^ means "start", $ means "end", [6-9] means "one digit from 6 to 9", and {9} means "exactly 9 times". The test method says whether some text fits the pattern.

const mobile = /^[6-9][0-9]{9}$/;   // 10 digits, first is 6, 7, 8 or 9
const pin = /^[1-9][0-9]{5}$/;      // 6 digits, first is not 0
const email = /^[^\s@]+@[^\s@]+\.[^\s@]+$/; // something@something.something

console.log(mobile.test('9876543210')); // true
console.log(mobile.test('5876543210')); // false: starts with 5
console.log(pin.test('560001'));        // true (Bengaluru)
console.log(pin.test('56001'));         // false: only 5 digits
console.log(email.test('asha@example.in')); // true
console.log(email.test('asha@example'));    // false: no dot after @

Collect every error

Do not stop at the first problem. Check every field and collect the problems in a list, each with the field name and a clear message. Then the app can mark all the wrong boxes at once, and the user fixes everything in one go.

function validateProduct(body) {
  const errors = [];
  if (typeof body.name !== 'string' || body.name.trim().length < 2) {
    errors.push({ field: 'name', message: 'Name must have at least 2 letters' });
  }
  if (typeof body.price !== 'number' || body.price <= 0) {
    errors.push({ field: 'price', message: 'Price must be a number above 0' });
  }
  return errors;
}

console.log(validateProduct({ name: 'Tea', price: 140 })); // []
console.log(validateProduct({ name: ' ', price: '140' })); // two errors

400 or 422?

Use 400 Bad Request when the request itself is broken: the body is not valid JSON, or it is not an object at all. Use 422 Unprocessable Content when the JSON is fine but a value breaks a rule, like a mobile number with 8 digits. Many teams use 400 for both. What matters most is that you choose one style and use it everywhere.