How do I sanitize input with Zod?
Use Zod transforms. z.string().email().toLowerCase().trim() lowercases and trims the email before validating. z.string().min(1).trim() removes leading and trailing whitespace. Sanitization happens in the schema.
Verify This Answer
Cross-check this information using these trusted sources:
More FAQs in What Is Data Sanitization and Why It Matters in Node.js
Cleaning input before it touches your app. Stripping dangerous characters ($ and . for NoSQL, < and > for XSS), escaping HTML, trimming whitespace, normalizing emails, and casting types. Sanitization prevents injection attacks.
Validation rejects bad input (is this valid?). Sanitization cleans input (is this safe?). Use both. Validate the shape with Zod, then sanitize the values with transforms and middlewares.
Strips $ and . from req.body, req.params, and req.query. Without it, a user can send { $gt: '' } as a query and bypass auth. Add it after express.json so all bodies are sanitized.
Still have questions?
Browse all our FAQs or reach out to our support team