Re: Do we consider input validation when designing?

[Rick James]

Input validation MUST come BEFORE touching the database. Else a hacker could mangle your statements and do naughty things.

OTOH, once you have validated that the input is a string of letters, you could do a SELECT to see if that string is in a table of valid words.

Or, after checking that the input looks like a phone number (suitable digits, dashes, etc and NO other characters), then you could do a SELECT to see if it a valid phone number.

SELECT COUNT(*) FROM tbl WHERE foo = '....';
Then see if you get back 0 (absent) or 1 (present in the table). Depending on the situation, you could get back more than 1.