Sanitization methods in Express - Mini Project: Build & Apply

Sanitization Methods in Express

📖 Scenario: You are building a simple Express server that accepts user input from a form. To keep the server safe and clean, you need to sanitize the input data before using it.

🎯 Goal: Create an Express app that sanitizes a user input field called username by trimming spaces and escaping special characters.

📋 What You'll Learn

Create an Express app with a POST route at /submit

Use express-validator sanitization methods to trim and escape the username field

Send back the sanitized username in the response

💡 Why This Matters

🌍 Real World

Sanitizing user input is essential to prevent security issues like cross-site scripting (XSS) and to ensure clean data storage.

💼 Career

Backend developers often use Express and express-validator to build secure APIs that handle user data safely.

1

Setup Express app and body parser

Create an Express app by importing express and calling express(). Use express.json() middleware to parse JSON request bodies.

Express

const express = require('express');
const app = express();

// Your code here

Hint

Remember to import express and create an app instance. Use app.use(express.json()) to parse JSON bodies.

2

Add express-validator import and setup POST route

Import body from express-validator. Add a POST route at /submit that accepts a JSON body.

Express

const express = require('express');
const app = express();

app.use(express.json());

// Your code here

Hint

Import body from express-validator. Create a POST route handler for /submit.

3

Apply sanitization methods to username

Inside the POST route, use body('username').trim().escape() to sanitize the username field. Use req.body.username to access the input.

Express

const express = require('express');
const app = express();
const { body } = require('express-validator');

app.use(express.json());

app.post('/submit', (req, res) => {
  // Sanitize username here
  // Your code here
});

Hint

Use body('username').trim().escape() as middleware in the POST route to sanitize the input.

4

Send back sanitized username in response

Inside the POST route handler, get the sanitized username from req.body.username and send it back in JSON format with key sanitizedUsername.

Express

const express = require('express');
const app = express();
const { body, validationResult } = require('express-validator');

app.use(express.json());

app.post('/submit', [
  body('username').trim().escape()
], (req, res) => {
  // Send response with sanitized username
  // Your code here
});

Hint

Access req.body.username after sanitization and send it back using res.json().

Practice

1. What is the main purpose of sanitization methods in Express applications?

easy

A. To compress files before sending

B. To speed up server response time

C. To format dates and times

D. To clean user input and prevent security issues

Solution

1. Step 1: Understand sanitization role

   Sanitization methods clean user input to remove harmful or unwanted characters.

2. Step 2: Identify security purpose

   This cleaning helps prevent security problems like injection attacks.

3. Final Answer:

   To clean user input and prevent security issues -> Option D

4. Quick Check:

   Sanitization = Clean input for safety [OK]

Hint: Sanitization means cleaning input to keep safe [OK]

Common Mistakes:

• Confusing sanitization with performance optimization
• Thinking sanitization formats dates
• Assuming sanitization compresses data

2. Which Express sanitizer method removes whitespace from both ends of a string?

easy

A. trim()

B. escape()

C. normalizeEmail()

D. toLowerCase()

Solution

1. Step 1: Identify method purpose

   The trim() method removes spaces from the start and end of a string.

2. Step 2: Compare other methods

   escape() converts special characters, normalizeEmail() formats emails, toLowerCase() changes case.

3. Final Answer:

   trim() -> Option A

4. Quick Check:

   Remove spaces = trim() [OK]

Hint: Trim cuts spaces at string ends [OK]

Common Mistakes:

• Choosing escape() to remove spaces
• Confusing normalizeEmail() with trimming
• Using toLowerCase() for whitespace removal

3. What will be the output of this Express sanitizer code?

const { body, validationResult } = require('express-validator');

app.post('/submit', [
  body('email').normalizeEmail(),
  body('username').trim().escape()
], (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(400).json({ errors: errors.array() });
  }
  res.send({ email: req.body.email, username: req.body.username });
});

If the input is:
{ email: ' [e-mail] ', username: ' John ' }

medium

A. { email: '[e-mail]', username: 'John' }

B. { email: ' [e-mail] ', username: ' John ' }

C. { email: '[e-mail]', username: '<b>John</b>' }

D. { email: '[e-mail]', username: 'John' }

Solution

1. Step 1: Apply normalizeEmail()

   This method lowercases and trims the email, so ' [e-mail] ' becomes '[e-mail]'.

2. Step 2: Apply trim() and escape() on username

   Trim removes spaces around 'John', escape converts < and > to < and > to prevent HTML injection.

3. Final Answer:

   { email: '[e-mail]', username: '<b>John</b>' } -> Option C

4. Quick Check:

   Email normalized, username trimmed & escaped = { email: '[e-mail]', username: '<b>John</b>' } [OK]

Hint: Normalize email, trim and escape username [OK]

Common Mistakes:

• Ignoring escape() effect on username
• Not trimming email before normalization
• Assuming username keeps HTML tags

4. Identify the error in this Express sanitization code snippet:

app.post('/data', (req, res) => {
  req.body.name = req.body.name.trim.escape();
  res.send(req.body.name);
});

medium

A. escape() is not a function on string directly

B. trim() should be called after escape()

C. Chaining trim and escape without parentheses is invalid

D. Missing middleware to parse req.body

Solution

1. Step 1: Check method chaining on string

   JavaScript strings have trim() but not escape() method directly.

2. Step 2: Understand escape() usage

   escape() is provided by express-validator or similar libraries, not native string method.

3. Final Answer:

   escape() is not a function on string directly -> Option A

4. Quick Check:

   escape() needs library, not string method [OK]

Hint: escape() is not a native string method [OK]

Common Mistakes:

• Assuming escape() works on plain strings
• Thinking trim() must come after escape()
• Ignoring need for body parser middleware

5. You want to sanitize a user's profile input before saving to the database. The input includes email, username, and bio. Which combination of sanitization methods is best to ensure safe and clean data?

hard

A. Use trim() for all fields only

B. Use normalizeEmail() for email, trim() and escape() for username, and escape() for bio

C. Use escape() for email and username, no sanitization for bio

D. Use normalizeEmail() for email, no sanitization for username and bio

Solution

1. Step 1: Sanitize email properly

   normalizeEmail() formats and cleans email addresses correctly.

2. Step 2: Clean username and bio

   trim() removes extra spaces, escape() prevents harmful HTML or scripts in username and bio.

3. Final Answer:

   Use normalizeEmail() for email, trim() and escape() for username, and escape() for bio -> Option B

4. Quick Check:

   Proper sanitization per field = Use normalizeEmail() for email, trim() and escape() for username, and escape() for bio [OK]

Hint: Normalize email, trim and escape text fields [OK]

Common Mistakes:

• Skipping escape() on bio allowing HTML injection
• Using only trim() which doesn't prevent scripts
• Not normalizing email causing inconsistent data