Secure User Input and Prevent Vulnerabilities

Input Sanitization Expert is a prompt that provides validation, sanitization, and context-specific encoding patterns to protect applications from security vulnerabilities. The source material includes allowlist-based validation patterns, HTML/JavaScript encoding functions, file upload sanitization, and URL/path validation examples to prevent injection attacks, XSS, directory traversal, and open redirects.

Use this prompt when building web applications that accept user input through forms, file uploads, URL parameters, or API endpoints. Apply it when implementing authentication systems, content management features, search functionality, or any feature that processes untrusted data. The source includes validation patterns for email addresses, usernames, phone numbers, filenames, and numeric inputs.

Do NOT use this as a replacement for parameterized queries - always use your database library's built-in parameterization. Do NOT rely solely on these patterns without understanding your specific security context and threat model.

You provide raw user input strings, file data, URLs, or path parameters along with validation requirements (pattern type, length limits, allowed values). The patterns return validated and sanitized data, encoded output safe for specific contexts (HTML, JavaScript, SQL), safe filenames, or None/null for invalid input that should be rejected.

The source material includes Python code examples using standard library modules and JavaScript encoding functions. Here's the core validation pattern from the source:

import re
from typing import Optional

class InputValidator:
    # Allowlist patterns for common inputs
    PATTERNS = {
        'email': r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$',
        'username': r'^[a-zA-Z0-9_]{3,20}$',
        'phone': r'^\+?1?[0-9]{10,14}$',
        'alphanumeric': r'^[a-zA-Z0-9]+$',
        'safe_filename': r'^[a-zA-Z0-9._-]+$'
    }
    
    @staticmethod
    def validate_input(value: str, pattern_type: str, max_length: int = 255) -> Optional[str]:
        if not value or len(value) > max_length:
            return None
            
        pattern = InputValidator.PATTERNS.get(pattern_type)
        if pattern and re.match(pattern, value):
            return value.strip()
        return None

This prompt serves backend developers building secure web applications, security engineers implementing input validation layers, full-stack developers handling user-generated content, and DevOps teams establishing secure coding standards. It's valuable for teams migrating from client-side-only validation to server-side security controls, developers working with file uploads or dynamic content rendering, and anyone responsible for preventing OWASP Top 10 vulnerabilities in production systems.