0Pricing
JavaScript Academy · Lesson

Input validation, escaping basics

Validate and normalize inputs with small allowlists and guards; escape risky characters before showing text.

Input validation, escaping basics is a free JavaScript Academy lesson on CoddyKit — lesson 1 of 3. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the JavaScript Academy learning path, one of 3 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Big picture

Goal: Make inputs boring and safe.

  • Use guard clauses to reject early
  • Prefer allowlists over vague rules
  • Normalize to a simple shape
  • Escape special chars before showing text
Input validation, escaping basics — illustration 1

Number guard basics

Add simple guards: type check, range check, and normalize to a final value.

// Validate age: number and range guard
function parseAge(input) {
  // trim and parse
  const n = Number(input);
  if (!Number.isFinite(n)) return null; // reject non-numbers
  if (n < 0 || n > 130) return null;    // reject out-of-range
  return Math.floor(n);                  // normalize to integer
}

console.log("age ok:", parseAge("21"));
console.log("age bad:", parseAge("twenty"));
Input validation, escaping basics — illustration 2

Escape for safe display

Before showing user text, escape special characters so the UI treats it as plain text.

// Escape a few risky characters before displaying in HTML contexts
function escapeText(s) {
  if (typeof s !== "string") return "";
  return s
    .replaceAll("&", "&amp;")
    .replaceAll("<", "&lt;")
    .replaceAll(">", "&gt;")
    .replaceAll("\"", "&quot;")
    .replaceAll("'", "&#39;");
}

console.log("escaped:", escapeText("<b>Hello & bye</b>"));
Input validation, escaping basics — illustration 3

Allowlists in practice

Prefer allowlists for fixed sets (like codes or roles). Normalize case and spacing.

// Allowlist example: only certain country codes
const ALLOWED = new Set(["TR", "US", "DE", "GB"]);

function parseCountry(code) {
  if (typeof code !== "string") return null;
  const up = code.trim().toUpperCase();
  if (!ALLOWED.has(up)) return null; // reject unknown
  return up; // normalized
}

console.log("country ok:", parseCountry("tr"));
console.log("country bad:", parseCountry("xx"));
Input validation, escaping basics — illustration 4

Tiny object validator

Check type and bounds, then return a normalized shape that the rest of your code can trust.

// Validate a tiny user object and normalize
function validateUser(input) {
  if (typeof input !== "object" || input === null) return null;

  const nameOk = typeof input.name === "string" && input.name.trim().length >= 1 && input.name.trim().length <= 40;
  const ageOk = parseAge(input.age) !== null;

  if (!nameOk || !ageOk) return null;

  return {
    name: input.name.trim(),
    age: parseAge(input.age)
  };
}

console.log("user ok:", validateUser({ name: " Ayla ", age: "22" }));
console.log("user bad:", validateUser({ name: "", age: "old" }));
Input validation, escaping basics — illustration 5

Good defensive habits

Tips:

  • Validate at the edges (user input, network).
  • Use allowlists, ranges, and type checks.
  • Normalize once; keep the rest simple.
  • Escape before showing text to users.
Input validation, escaping basics — illustration 6

Defensive input basics quiz

Quick check: Safe input pattern.

Input validation, escaping basics — illustration 7

Recap

Recap: Guard early, use allowlists, normalize to a safe shape, and escape before display. Keep each step tiny and readable.

Input validation, escaping basics — illustration 8

Frequently asked questions

Is the “Input validation, escaping basics” lesson free?

Yes — the full text of “Input validation, escaping basics” is free to read here on the web, and the JavaScript Academy course includes 3 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the JavaScript Academy course, upgrade to CoddyKit PRO.

What will I learn in “Input validation, escaping basics”?

Validate and normalize inputs with small allowlists and guards; escape risky characters before showing text. You practise JavaScript Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start JavaScript Academy?

No prior experience is required. JavaScript Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 3, so you can start here or from the beginning and move at your own pace.

How long does the “Input validation, escaping basics” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this JavaScript Academy lesson?

Yes. Every JavaScript Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Input validation, escaping basics
  2. Safe object merging; freezing & sealing
  3. Error boundaries (conceptual) without frameworks
← Back to JavaScript Academy