All input validated frontend + backend against XSS/SQLi/LDAP injection

User input that flows directly into a database query, HTML output, or LDAP filter without server-side validation is the root cause of SQL injection, stored XSS, and LDAP injection — three of the most consistently exploited vulnerability classes. NIST 800-53 rev5 SI-10 (Information Input Validation) requires validation of all inputs for type, length, format, and range; SC-18 restricts execution of mobile or untrusted code. FedRAMP rev5 SI-10 applies to all federal cloud systems. CWE-89 (SQL Injection) and OWASP A03 (Injection) have appeared in every OWASP Top 10 since its inception. A single unvalidated search field in a Prisma raw query is sufficient to dump the entire database.

Parse every API request body with a Zod schema before touching the database. Use Prisma or another ORM for all queries — never construct SQL strings from user input.

// app/api/search/route.ts
import { z } from 'zod'
import { prisma } from '@/lib/prisma'

const SearchInput = z.object({
  query: z.string().min(1).max(200).trim(),
  category: z.enum(['projects', 'audits', 'users'])
})

export const POST = async (req: Request) => {
  const parsed = SearchInput.safeParse(await req.json())
  if (!parsed.success) {
    return Response.json({ error: 'Invalid input' }, { status: 400 })
  }
  const { query, category } = parsed.data
  // Prisma uses parameterized queries — no injection risk
  const results = await prisma.project.findMany({
    where: { name: { contains: query, mode: 'insensitive' } }
  })
  return Response.json(results)
}

For any HTML rendering of user content, use DOMPurify.sanitize() before assignment. Never use innerHTML with unescaped user data. Validate on both POST and GET (query-string parameters are equally dangerous).