Input Validation

Validation asks whether input satisfies the domain; sanitization transforms it. Validate at the boundary and retain a structured error list for clients.

Practical example

<?php
$email = filter_var($rawEmail, FILTER_VALIDATE_EMAIL);
$role = in_array($rawRole, ['viewer', 'editor'], true) ? $rawRole : null;
if ($email === false || $role === null) { throw new InvalidArgumentException('Invalid input'); }

Use allowlists for finite choices, explicit lengths/ranges, Unicode-aware rules, and cross-field validation. Sanitization is not a substitute for output encoding or SQL parameters. Avoid silent truncation that changes meaning.