Input Validation
: The process of verifying that user-supplied data meets expected format, type, length, and range constraints before the application processes it. Input validation is the first line of defense against injection attacks, ensuring that malicious data is rejected or sanitized before reaching sensitive operations like database queries, system commands, or rendered output.
Why It Matters for AI-Coded Apps
AI-generated code consistently under-validates input. LLMs generate the ‘happy path’ where inputs are well-formed, but rarely add validation for malicious or malformed data. Every injection vulnerability (SQL injection, XSS, command injection, SSRF) ultimately stems from insufficient input validation.
Real-World Example
A registration form accepts an email field. Without validation, an attacker submits admin@evil.com<script>alert('xss')</script>. Proper validation would check: is it a string? Does it match an email regex? Is it under 254 characters? Does the domain have MX records? Each check reduces the attack surface.
How to Detect and Prevent It
Validate on both client-side (UX) and server-side (security). Use allowlists over denylists when possible. Validate type, length, format, and range. Use schema validation libraries (Zod, Yup, Pydantic) for structured validation. Never trust client-side validation alone – it can be bypassed.
Frequently Asked Questions
What is the difference between validation and sanitization?
Validation checks if input meets expectations and rejects invalid data (e.g., email format check). Sanitization modifies input to make it safe (e.g., stripping HTML tags). Use validation first (reject bad input), then sanitize as defense-in-depth where needed.
Should I validate on the client or server?
Both. Client-side validation improves UX with instant feedback. Server-side validation is the security control – it cannot be bypassed. Never rely on client-side validation alone because attackers can modify requests directly, bypassing the browser entirely.
What validation library should I use?
TypeScript/JavaScript: Zod (best for runtime + type inference), Yup (form-focused), Joi (comprehensive). Python: Pydantic (data models), Marshmallow (serialization). Go: go-playground/validator. Choose based on your framework’s ecosystem and use it consistently across all endpoints.
Scan your app for security issues automatically
Vibe Eval checks for 200+ vulnerabilities in AI-generated code.
Try Vibe Eval