Input validation and sanitization in Node.js - Mini Project: Build & Apply

Input Validation and Sanitization in Node.js

📖 Scenario: You are building a simple Node.js server that accepts user input for a username and email. To keep the server safe and clean, you need to check that the input is valid and remove any unwanted characters.

🎯 Goal: Build a Node.js script that validates and sanitizes user input for username and email before using it.

📋 What You'll Learn

Create an object called userInput with keys username and email and exact values.

Add a variable called emailPattern to hold a regular expression for validating emails.

Use a function called sanitizeInput to clean the username by removing spaces and special characters.

Add a final check that uses emailPattern.test() to validate the email and store the result in isEmailValid.

💡 Why This Matters

🌍 Real World

Validating and cleaning user input is essential to prevent errors and security issues in web servers and applications.

💼 Career

Input validation and sanitization are key skills for backend developers, security engineers, and anyone working with user data.

1

Create the initial user input object

Create an object called userInput with these exact entries: username set to " user!name123 " and email set to "[e-mail]".

Node.js

# Create the userInput object with username and email
# Your code here

Hint

Use const userInput = { username: " user!name123 ", email: "[e-mail]" }.

2

Add email validation pattern

Add a variable called emailPattern and assign it a regular expression that matches a simple email format: one or more word characters, an @ symbol, one or more word characters, a dot, and two to four letters.

Node.js

const userInput = {
  username: "  user!name123 ",
  email: "[e-mail]"
};

// Add the emailPattern regular expression below
// Your code here

Hint

Use const emailPattern = /^\w+@\w+\.\w{2,4}$/; to match emails like [e-mail].

3

Sanitize the username input

Write a function called sanitizeInput that takes a string and returns it with all spaces and special characters removed, leaving only letters and numbers. Then create a variable cleanUsername by calling sanitizeInput with userInput.username.

Node.js

const userInput = {
  username: "  user!name123 ",
  email: "[e-mail]"
};

const emailPattern = /^\w+@\w+\.\w{2,4}$/;

// Write sanitizeInput function and create cleanUsername
// Your code here

Hint

Use str.replace(/[^a-zA-Z0-9]/g, '') to remove unwanted characters.

4

Validate the email input

Add a variable called isEmailValid that stores the result of testing userInput.email against emailPattern using emailPattern.test().

Node.js

const userInput = {
  username: "  user!name123 ",
  email: "[e-mail]"
};

const emailPattern = /^\w+@\w+\.\w{2,4}$/;

function sanitizeInput(str) {
  return str.replace(/[^a-zA-Z0-9]/g, '');
}

const cleanUsername = sanitizeInput(userInput.username);

// Add isEmailValid variable using emailPattern.test()
// Your code here

Hint

Use const isEmailValid = emailPattern.test(userInput.email); to check email validity.

Practice

1. What is the main purpose of input validation in a Node.js application?

easy

A. To check if the input data is correct and safe before processing

B. To store user data in the database

C. To format the output data for display

D. To speed up the server response time

Solution

1. Step 1: Understand input validation

   Input validation ensures that the data received from users meets expected rules and is safe to use.

2. Step 2: Identify the purpose in Node.js

   In Node.js, input validation prevents bad or harmful data from causing errors or security issues.

3. Final Answer:

   To check if the input data is correct and safe before processing -> Option A

4. Quick Check:

   Input validation = check data safety [OK]

Hint: Validation means checking data correctness and safety [OK]

Common Mistakes:

• Confusing validation with data storage
• Thinking validation formats output
• Assuming validation improves speed

2. Which of the following is the correct way to import the express-validator middleware in a Node.js file using ES modules?

easy

A. const { check } = require('express-validator');

B. import check from 'express-validator';

C. const check = require('express-validator/check');

D. import { check } from 'express-validator';

Solution

1. Step 1: Identify modern import syntax

   Node.js with ES modules uses import { check } from 'express-validator'; to import named exports.

2. Step 2: Check other options

   const { check } = require('express-validator'); uses CommonJS require but destructuring is possible only if CommonJS is used; import check from 'express-validator'; imports default which express-validator does not export; const check = require('express-validator/check'); uses a wrong path.

3. Final Answer:

   import { check } from 'express-validator'; -> Option D

4. Quick Check:

   Use ES module import for express-validator [OK]

Hint: Use ES module import syntax with curly braces for named exports [OK]

Common Mistakes:

• Using require instead of import in ES modules
• Importing default instead of named export
• Using incorrect module paths

3. Consider this Node.js code snippet using express-validator:

app.post('/submit', [
  check('email').isEmail(),
  check('age').isInt({ min: 18 })
], (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(400).json({ errors: errors.array() });
  }
  res.send('Data is valid');
});

What will be the response if the user sends { "email": "userexample.com", "age": 17 }?

medium

A. Status 400 with error about missing fields

B. Status 400 with errors about invalid email and age

C. Status 500 server error

D. Status 200 with message 'Data is valid'

Solution

1. Step 1: Analyze validation rules

   The code checks if 'email' is a valid email and 'age' is an integer >= 18.

2. Step 2: Check input values

   The email 'userexample.com' is missing '@', so invalid. Age 17 is less than 18, so invalid.

3. Final Answer:

   Status 400 with errors about invalid email and age -> Option B

4. Quick Check:

   Invalid email and age cause 400 error [OK]

Hint: Invalid inputs trigger 400 with error details [OK]

Common Mistakes:

• Assuming invalid data passes validation
• Confusing status codes
• Ignoring validationResult usage

4. You wrote this code to sanitize input but it doesn't remove spaces as expected:

app.post('/data', [
  check('username').trim().escape()
], (req, res) => {
  // ...
});

What is the likely reason the spaces are not removed?

medium

A. You must call sanitize() before trim()

B. escape() removes spaces but trim() does not

C. The trim() method removes spaces only from start and end, not inside the string

D. The check() function does not support trim()

Solution

1. Step 1: Understand trim() behavior

   The trim() method removes whitespace only from the start and end of a string, not inside it.

2. Step 2: Check escape() effect

   escape() converts special characters but does not remove spaces inside the string.

3. Final Answer:

   The trim() method removes spaces only from start and end, not inside the string -> Option C

4. Quick Check:

   trim() trims edges, not inner spaces [OK]

Hint: trim() only removes spaces at string ends [OK]

Common Mistakes:

• Expecting trim() to remove all spaces
• Misunderstanding escape() purpose
• Thinking check() lacks trim() support

5. You want to create a Node.js API endpoint that accepts a username and email. The username must be alphanumeric and trimmed, and the email must be valid and normalized. Which express-validator chain correctly applies validation and sanitization?

hard

A. [ check('username').trim().isAlphanumeric(), check('email').normalizeEmail().isEmail() ]

B. [ check('username').isAlphanumeric().trim(), check('email').isEmail().normalizeEmail() ]

C. [ check('username').escape().isAlphanumeric(), check('email').isEmail().trim() ]

D. [ check('username').isAlphanumeric().escape(), check('email').trim().normalizeEmail() ]

Solution

1. Step 1: Validate username and email correctly

   Username must be alphanumeric and trimmed, so trim() before or after is okay but isAlphanumeric() must check the trimmed string. Email must be checked with isEmail() and normalized with normalizeEmail().

2. Step 2: Analyze options

   [ check('username').trim().isAlphanumeric(), check('email').normalizeEmail().isEmail() ] applies trim() before isAlphanumeric() which ensures validation on trimmed string; [ check('username').isAlphanumeric().trim(), check('email').isEmail().normalizeEmail() ] applies isAlphanumeric() before trim(), which may validate untrimmed input; also, normalizeEmail() should come before isEmail() to validate normalized email; [ check('username').escape().isAlphanumeric(), check('email').isEmail().trim() ] escapes username unnecessarily and trims email which is not needed; [ check('username').isAlphanumeric().escape(), check('email').trim().normalizeEmail() ] escapes username and trims email incorrectly.

3. Final Answer:

   [ check('username').trim().isAlphanumeric(), check('email').normalizeEmail().isEmail() ] -> Option A

4. Quick Check:

   Trim before validation for username; normalize before validation for email [OK]

Hint: Trim before validation for username; normalize before validation for email [OK]

Common Mistakes:

• Applying sanitization after validation incorrectly
• Using escape() unnecessarily
• Trimming email instead of normalizing