Data Validation Complete Guide
Master data validation techniques for secure, robust applications. Learn input validation, sanitization, schema validation, type checking, and industry best practices.
Why Data Validation Matters
Data validation is the process of ensuring data is correct, complete, and secure before processing. It's your first line of defense against security vulnerabilities, data corruption, and application crashes.
⚠️ Critical Security Principle:
Never trust user input. Always validate and sanitize data from any external source including forms, APIs, file uploads, and URL parameters.
Types of Validation
1. Client-Side Validation
Validation performed in the browser before data is sent to the server.
✓ Advantages:
- • Immediate feedback
- • Better UX
- • Reduces server load
- • Faster response
⚠ Limitations:
- • Can be bypassed
- • Not security sufficient
- • JavaScript required
- • Must duplicate server-side
2. Server-Side Validation
Validation performed on the server. This is mandatory for security.
✓ Essential Features:
- • Cannot be bypassed by users
- • Protects against malicious input
- • Validates all data regardless of source
- • Required for security compliance
3. Database-Level Validation
Constraints and rules enforced by the database (UNIQUE, NOT NULL, CHECK constraints).
Common Validation Techniques
Type Validation
Ensure data is of the expected type:
// JavaScript type validation
function validateAge(age) {
if (typeof age !== 'number') {
throw new Error('Age must be a number');
}
if (age < 0 || age > 150) {
throw new Error('Age must be between 0 and 150');
}
return true;
}Format Validation
Validate data matches expected patterns using regex:
Email Validation:
/^[^\s@]+@[^\s@]+\.[^\s@]+$/Phone (US):
/^\(\d3\) \d3-\d4$/URL:
/^https?:\/\/.+\..+/Range Validation
Ensure values fall within acceptable ranges:
- → Minimum and maximum values
- → Length constraints (strings, arrays)
- → Date ranges (past/future restrictions)
- → File size limits
Required Field Validation
Ensure mandatory fields are present and not empty:
function validateRequired(data, requiredFields) {
for (const field of requiredFields) {
if (!data[field] || data[field].trim() === '') {
throw new Error(`${field} is required`);
}
}
}Schema Validation
Schema validation uses a predefined structure to validate complex data. JSON Schema is the industry standard for JSON validation.
Example JSON Schema:
{
"type": "object",
"required": ["name", "email", "age"],
"properties": {
"name": {
"type": "string",
"minLength": 2,
"maxLength": 50
},
"email": {
"type": "string",
"format": "email"
},
"age": {
"type": "integer",
"minimum": 18,
"maximum": 120
}
}
}Sanitization & Security
Common Security Threats
- → SQL Injection: Malicious SQL in input fields
- → XSS (Cross-Site Scripting): Injected JavaScript code
- → Command Injection: Shell commands in user input
- → Path Traversal: Directory navigation in file paths
Sanitization Best Practices
- ✓ Use parameterized queries for database operations
- ✓ Escape HTML entities before displaying user content
- ✓ Whitelist allowed characters instead of blacklisting
- ✓ Validate file uploads (type, size, content)
- ✓ Use Content Security Policy (CSP) headers
Validation Libraries
JavaScript/Node.js
- • Joi - Schema validation
- • Yup - Object schema validation
- • Validator.js - String validators
- • Ajv - JSON Schema validator
- • Zod - TypeScript-first validation
Python
- • Pydantic - Data validation
- • Marshmallow - Serialization
- • Cerberus - Lightweight validator
- • jsonschema - JSON Schema
- • WTForms - Form validation
Error Handling
User-Friendly Error Messages
❌ Bad:
"Invalid input"
"Error 400"
"Validation failed"
✓ Good:
"Email must be valid"
"Age must be 18-120"
"Password needs 8+ chars"
Validation Response Structure
{
"valid": false,
"errors": [
{
"field": "email",
"message": "Email format is invalid",
"code": "INVALID_FORMAT"
},
{
"field": "age",
"message": "Age must be at least 18",
"code": "MIN_VALUE"
}
]
}Best Practices Checklist
Always validate server-side — Client-side validation is for UX only
Fail securely — Reject invalid data, don't try to "fix" it
Use whitelisting — Allow known good patterns, not block known bad ones
Validate early — Check data as soon as it enters your system
Log validation failures — Track patterns of invalid input attempts
Test validation logic — Unit test with both valid and invalid inputs