Validate all input on both client and server.
Client-side validation:
- Better UX (immediate feedback)
- Can be bypassed (never trust it alone)
Server-side validation:
- Authoritative check
- Required for security
What to validate:
- Type: Is it a string, number, etc?
- Length: Within expected bounds?
- Format: Valid email, URL, date?
- Range: Number within acceptable range?
Sanitization: Remove or escape dangerous characters before use.
**Never interpolate raw user input into SQL, HTML, or JavaScript.