What Is Data Sanitization and Why It Matters in Node.js
Sanitization is cleaning input before it touches your app. Here is what it is and why it matters.
What Is Data Sanitization and Why It Matters in Node.js
Sanitization is cleaning input before it touches your app. Validation asks "is this valid?"; sanitization asks "is this safe?". Both matter.
What Sanitization Prevents
- NoSQL injection: a user sends { $gt: '' } as a query and bypasses auth.
- XSS: a user submits <script>...</script> in a field and it runs in another user's browser.
- SQL injection (rare with Mongoose): crafted strings that break out of queries.
- Path traversal: crafted strings that access files outside a directory.
- Prototype pollution: a user sends { proto: { isAdmin: true } } and pollutes Object.prototype.
Types of Sanitization
- Strip dangerous characters: $ and . for NoSQL, < and > for XSS.
- Escape HTML: convert < to < so it renders as text, not code.
- Trim whitespace: remove leading and trailing spaces from strings.
- Normalize: lowercase emails, canonicalize URLs.
- Cast types: convert string "18" to number 18 (Zod does this).
Sanitization vs Validation
Validation rejects bad input. Sanitization cleans input. Use both. Validate the shape (Zod), then sanitize the values.
Common Express Sanitization Middlewares
- express-mongo-sanitize: strips $ and . from req.body, req.params, req.query.
- xss-clean or dompurify: strips HTML tags from input.
- hpp: removes duplicate query params (HTTP Parameter Pollution).
- zod transform: custom sanitization in your schema.
Example: Zod Sanitization
const signupSchema = z.object({
email: z.string().email().toLowerCase().trim(),
firstName: z.string().min(1).trim(),
about: z.string().max(200).trim().optional()
});
toLowerCase and trim are sanitization. They clean the value before validation passes.
Why It Matters
One unsanitized field can compromise the whole app. NoSQL injection can bypass auth. XSS can steal sessions. Sanitization is cheap; recovery is not.
The Takeaway
Data sanitization cleans input to prevent NoSQL injection, XSS, SQL injection, path traversal, and prototype pollution. Use express-mongo-sanitize, xss-clean or dompurify, hpp, and Zod transforms. Sanitize AND validate. Sanitization is cheap; recovery is not.
Cleaning input before it touches your app. Stripping dangerous characters ($ and . for NoSQL, < and > for XSS), escaping HTML, trimming whitespace, normalizing emails, and casting types. Sanitization prevents injection attacks.
Validation rejects bad input (is this valid?). Sanitization cleans input (is this safe?). Use both. Validate the shape with Zod, then sanitize the values with transforms and middlewares.
Strips $ and . from req.body, req.params, and req.query. Without it, a user can send { $gt: '' } as a query and bypass auth. Add it after express.json so all bodies are sanitized.
Use Zod transforms. z.string().email().toLowerCase().trim() lowercases and trims the email before validating. z.string().min(1).trim() removes leading and trailing whitespace. Sanitization happens in the schema.
One unsanitized field can compromise the whole app. NoSQL injection can bypass auth. XSS can steal sessions. Prototype pollution can grant admin. Sanitization is a one-liner; recovery from an attack is not.
Ready to master Node.js completely?
Want to upskill yourself, crack your next interview, and get your dream job? Join our comprehensive course to dive deeper with high-quality video tutorials, solve interview questions, and a premium community.
Master Node.js
Want to upskill yourself, crack your next interview, and get your dream job? Join our comprehensive course.