Understand why, learn the difference between validation and sanitization, pick a validator, write a validation middleware, validate body/params/query, add Mongoose validation, add express-mongo-sanitize, add xss-clean, add hpp, add helmet, use httpOnly cookies, whitelist filter fields, cap body size, rate limit auth routes, and test.

Why you need it. You cannot trust the client. Missing fields, wrong types, and injection attacks all come from unvalidated input. Once you understand the why, the how (Zod, express-validator, Mongoose validation) makes sense.

After you have validation in place. express-mongo-sanitize, xss-clean, and hpp are one-liners that add defense in depth. Add them after express.json and before your routes.