When I first started building backend applications, I didn’t take input validation seriously. My main focus was making sure the feature worked. If a user could submit a form and the data saved to the database, I considered it a success. I didn’t think much about what kind of data users were actually sending. Looking back, that was a huge mistake.
The first time I understood the importance of input validation was when one of my simple projects broke because of unexpected input. I had a form that accepted age as a number. Everything worked fine until someone entered text instead of a number. My app crashed. That was my wake-up call.
I realized something important: users will not always enter what you expect. Sometimes it’s a mistake. Sometimes it’s intentional. Either way, if I don’t validate input properly, my application becomes unstable and vulnerable.
After that experience, I changed my approach. Before saving anything to the database, I started asking myself:
1. Is this the correct data type?
2. Is the field required?
3. Is the input length reasonable?
4. Does this value make logical sense?
For example, if I’m accepting an email address, I check whether it follows a proper format. If I’m accepting a password, I check the minimum length. If I’m expecting a number, I make sure it’s actually a number and within a valid range.
