Interview question

What is input validation vs sanitization, and why do you need both? Input validation और sanitization में क्या अंतर है, दोनों क्यों ज़रूरी हैं?

Answer

Concept	Purpose	Example
Validation	Checks if data meets expected rules; rejects if not	Is this a valid email format?
Sanitization	Cleans/transforms data to make it safe	Strip HTML tags from a comment

// Validation - reject bad input
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    die('Invalid email');
}

// Sanitization - clean input for safe use
$comment = strip_tags($_POST['comment']);
$safeOutput = htmlspecialchars($comment, ENT_QUOTES, 'UTF-8');

Validation happens on input (accept or reject); sanitization/escaping should ideally happen on output, tailored to the context (HTML, SQL, URL, etc.) it's being used in.

Concept	उद्देश्य	उदाहरण
Validation	Data rules पूरे करता है या नहीं जांचता	Email valid format में है?
Sanitization	Data को safe बनाने के लिए साफ करता है	Comment से HTML tags हटाना

if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    die('Invalid email');
}

$comment = strip_tags($_POST['comment']);
$safeOutput = htmlspecialchars($comment, ENT_QUOTES, 'UTF-8');

Was this answer clear?

Subjects

Related questions