highUser input reaching your database

Missing Input Validation

User input from request body, params, or query is used without validation.

Why it matters

Unvalidated input is the root cause of injection attacks (SQL injection, NoSQL injection, command injection, XSS). An attacker can send unexpected data types, oversized strings, or malicious payloads through any input field.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Direct req.body usage
app.post('/api/users', (req, res) => {
  const name = req.body.name;
  db.insert({ name });
});

The smallest fix

minimal patch
// Validate with Zod:
import { z } from 'zod';
const schema = z.object({
  name: z.string().min(1).max(100),
  email: z.string().email(),
});
const data = schema.parse(req.body);

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

The file [the file] at line [the line number] uses unvalidated user input: [the flagged code]. Add input validation using Zod or a similar library.

How to check the fix worked

1. Send invalid data types — expect 400 error
2. Send oversized strings — expect 400 error
3. Send valid data — expect success

Further reading