The answer
Client-side validation is for UX, not security. A user can bypass it with curl, Postman, or a custom client. Always validate on the server, no matter what the client does.
Validation and Sanitization Interview Questions and Answers
Why validate on the server if you validate on the client?
More FAQs in Validation and Sanitization Interview Questions and Answers
Validation rejects bad input (is this valid?). Sanitization cleans input (is this safe?). Use both. Validate the shape with Zod, then sanitize the values with transforms and middlewares.
Use express-mongo-sanitize (strips $ and .), validate with Zod (enforces types), use Mongoose (casts based on schema), cast inputs explicitly with String(), avoid $where, and whitelist filter fields. Layer defenses.
Escape output (React does this by default), strip HTML from input with xss-clean or dompurify, set a Content Security Policy with helmet, use httpOnly cookies, and sanitize rich text on render.
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.