Customer contact validation

Without server-side contact field validation, malformed data reaches the database: null bytes in email fields break transactional email delivery, invalid phone numbers fail SMS delivery, and a booking with a corrupt contact record becomes impossible to reach for reminders or cancellations. OWASP A03 (Injection) covers malicious input reaching persistence; CWE-20 covers missing input validation generally. A booking where the customer cannot be contacted is, from an operational standpoint, as bad as a booking that was never created — except the slot is now blocked.

Run schema validation in the API route or server action (e.g., src/app/api/bookings/route.ts), not in the client component. Never rely on browser-side form validation for data that persists to the database.

import { z } from 'zod';

const BookingSchema = z.object({
  email: z.string().email(),
  phone: z.string().min(10).max(15).regex(/^\d+$/),
  firstName: z.string().min(1).max(100),
  lastName: z.string().min(1).max(100),
});

const parsed = BookingSchema.safeParse(req.body);
if (!parsed.success) return res.status(422).json({ errors: parsed.error.issues });