LetMeCheck.ai
    Start free
    Input validation
    Security

    What is input validation?

    SHORT ANSWER

    Input validation means checking everything a user sends to your app, such as form fields, URL values and uploaded files, to make sure it's the type, length and format you expect before you use it. Anything that doesn't fit is rejected.

    ON THIS PAGE
    What it meansWhy it matters for vibe-coded appsExampleHow to check if your app has this problemHow to fix it

    What it means

    Your app can't control what arrives at its doors. A name field can receive a 10,000-character string, a number field can receive a script, and a file upload can be something other than a picture.

    Validation on the page helps real users fix typos, but an attacker skips the page entirely. The check that counts is the one on your server.

    Why it matters for vibe-coded apps

    Many serious attacks, including SQL injection and cross-site scripting, start with input your app should have rejected. AI tools often validate in the browser only.

    IF THIS IS WRONG IN YOUR APP
    • Bad input can break your database queries or your pages.
    • Huge or oddly shaped requests can crash your server.
    • Unchecked uploads can let someone store harmful files.

    Example

    A sign-up route that saves whatever it receives.

    ✕ RISKYTrusts the request as it arrives
    app.post("/signup", async (req, res) => {
  await db.users.insert(req.body); // whatever the caller sent
  res.sendStatus(201);
});
    ✓ SAFERChecks the shape first, and keeps only known fields
    import { z } from "zod";

const Signup = z.object({
  email: z.string().email().max(254),
  name: z.string().min(1).max(80),
});

app.post("/signup", async (req, res) => {
  const data = Signup.parse(req.body); // throws if invalid
  await db.users.insert(data);
  res.sendStatus(201);
});

    Validate on the server every time. Rules in the browser are a convenience, not a safeguard.

    How to check if your app has this problem

    1. 1Search your server code for routes that use req.body, req.query or request params directly.
    2. 2Try sending an extremely long value, or a number where a word belongs, and see if the server accepts it.

    The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.

    Run a free scan →

    How to fix it

    1. 1Define the allowed shape for each route, with a library such as Zod.
    2. 2Set maximum lengths and allowed file types and sizes.
    3. 3Save only the fields you expect, never the whole request body.
    4. 4Return a clear error for anything that doesn't fit.
    FIX PROMPT · PASTE INTO YOUR AI TOOL

    Add server-side input validation to every API route in my app using Zod. Define a schema for each request body and query, set sensible length limits, accept only expected fields, and return a 400 error for anything invalid.

    Check if your app has this problem

    Paste your website and we'll check for input validation issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.

    Last updated

    Related terms

    Need help?

    Not sure what this means for your app? Our team will explain it in plain English.

    Contact support