Jangan pernah percaya input dari user! Selalu validasi sebelum memproses.

Validasi manual:

app.post("/users", (req, res) => {
  const { name, email, age } = req.body;
  const errors = [];

  if (!name || typeof name !== "string") {
    errors.push("Name is required and must be a string");
  }
  if (!email || !email.includes("@")) {
    errors.push("Valid email is required");
  }
  if (age !== undefined && (typeof age !== "number" || age < 0)) {
    errors.push("Age must be a positive number");
  }

  if (errors.length > 0) {
    return res.status(400).json({ errors });
  }

  // Data valid — proses...
  res.status(201).json({ name, email, age });
});

Pattern: validation middleware

function validateUser(req, res, next) {
  const { name, email } = req.body;
  if (!name) return res.status(400).json({ error: "Name required" });
  if (!email) return res.status(400).json({ error: "Email required" });
  next();
}

app.post("/users", validateUser, (req, res) => {
  // Di sini kita tahu data sudah valid
  res.status(201).json(req.body);
});

Tips validasi:

• Validasi tipe data (string, number, boolean)
• Validasi panjang string (min/max)
• Validasi format (email, phone, URL)
• Sanitize input (trim whitespace, escape HTML)
• Kembalikan pesan error yang jelas