# Input Validation

> Use when: validate and sanitize untrusted input at boundaries to prevent bad data and attacks.

- Skill: `kimtth/input-validation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kimtth/input-validation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kimtth/input-validation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: kimtth (https://skillmd.com/u/kimtth)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/kimtth/input-validation

---


Goal: reject or normalize untrusted input before it reaches logic.

Use for:
- handling user input, request bodies, and external data
- preventing injection and corrupt-state bugs
- defining a schema and rules at the boundary

Workflow:
1. Validate at the trust boundary, as early as possible.
2. Use an allowlist: accept known-good, reject the rest.
3. Check type, range, format, and length explicitly.
4. Normalize encoding before validating to avoid bypasses.
5. Return clear, specific validation errors.
6. Encode output for its destination context separately.

Patterns:
- schema validation for structured payloads
- allowlist over blocklist
- parse into typed values, do not pass raw strings around
- separate validation from business logic

Rules:
- never trust input; validate every external boundary
- prefer allowlists; blocklists miss cases
- validation is not a substitute for parameterized queries/encoding
- fail with specific, non-leaky error messages