Another lesson I learned was that frontend validation is not enough. At one point, I thought adding validation in JavaScript on the frontend solved the problem. But then I realized users can bypass frontend validation entirely. The backend must always validate input. The server is the final gatekeeper.

Skipping input validation doesn’t just cause bugs  it creates security risks. I started learning about issues like SQL injection and malicious payloads. That’s when I understood that validation isn’t just about keeping the app running; it’s about protecting it.

Now, input validation is one of the first things I implement when building a feature. I treat it as part of the feature, not an optional extra. If a route accepts data, validation is included from the beginning.

One thing that helped me improve was using validation libraries provided by frameworks. Instead of manually checking everything every time, I learned how to define validation rules clearly and consistently. That made my code cleaner and more secure.