Input validation and sanitization in Node.js - Step-by-Step Execution

Concept Flow - Input validation and sanitization

Receive user input

↓

Validate input format?

No→Reject input with error

Yes↓

Sanitize input to remove bad data

↓

Use cleaned input safely

↓

Respond to user

Input is first checked if it meets rules, then cleaned to remove harmful parts before use.

Execution Sample

Node.js

import { check, validationResult } from 'express-validator';

app.post('/submit', [
  check('email').trim().isEmail().normalizeEmail(),
  check('age').trim().isInt({ min: 1 }).toInt()
], (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) {
    return res.status(400).json({ errors: errors.array() });
  }
  // Use cleaned input safely, e.g., req.body.age is now a number
  res.json({ message: 'Success', data: req.body });
});

This code validates and sanitizes 'email' (trims, checks format, normalizes) and 'age' (trims, checks positive integer, converts to int) before processing. Invalid input is rejected with errors.

Execution Table

Step	Action	Input Example	Validation Result	Sanitization Result	Next Step
1	Receive input	{ email: '[e-mail]', age: '25' }	Not checked yet	Not sanitized yet	Validate input
2	Validate 'email'	[e-mail]	Valid email	N/A	Validate 'age'
3	Validate 'age'	25	Valid integer >=1	N/A	Sanitize input
4	Sanitize 'email'	[e-mail]	Valid	[e-mail]	Sanitize 'age'
5	Sanitize 'age'	25	Valid	25	Use cleaned input
6	Use input safely	{ email: '[e-mail]', age: 25 }	Valid	Cleaned	Respond to user
7	Respond	Success message	N/A	N/A	End

💡 Input rejected if validation fails; otherwise sanitized and used safely.

Variable Tracker

Variable	Start	After Validation	After Sanitization	Final
email	undefined	[e-mail] (valid)	[e-mail] (clean)	[e-mail]
age	undefined	'25' (valid)	25 (number)	25
errors	undefined	empty (no errors)	empty	empty

Key Moments - 3 Insights

Why do we check validation before sanitization?

Validation ensures input meets rules before cleaning. See execution_table steps 2 and 3 where validation happens first to catch bad input early.

What happens if validation fails?

Input is rejected immediately with an error. This is shown in the exit_note and implied by the flow after step 1 if validation is No.

Why convert 'age' from string to number during sanitization?

Sanitization cleans and converts input to correct types for safe use. See variable_tracker where 'age' changes from string '25' to number 25 after sanitization.

Visual Quiz - 3 Questions

Look at the execution_table at step 3, what is the validation result for 'age'?

A Invalid integer

B Valid integer >=1

C Missing value

D Not checked yet

💡 Hint

Check the 'Validation Result' column at step 3 in execution_table.

At which step does the input get sanitized?

A Step 2

B Step 6

C Step 4

D Step 1

💡 Hint

Look for 'Sanitize input' action in execution_table rows.

If the email was 'bad-email', what would happen at step 2?

A Validation fails and input is rejected

B Validation passes

C Sanitization fixes it automatically

D Input is accepted without changes

💡 Hint

Refer to key_moments about validation failing and exit_note.

Concept Snapshot

Input validation checks if data meets rules (like email format).
Sanitization cleans data (removes bad parts, converts types).
Validate first to catch errors early.
Sanitize before using input to keep app safe.
Reject invalid input to avoid problems.
Use libraries like express-validator in Node.js.

Full Transcript

Input validation and sanitization in Node.js means first checking if user data fits expected rules, like a proper email or positive number. If it passes, we clean the data to remove harmful parts or convert types. This process helps keep the app safe and working well. The flow starts by receiving input, validating each field, then sanitizing it, and finally using the cleaned data. If validation fails, the input is rejected immediately. This step-by-step ensures only good data is processed.