Input validation and sanitization

Input validation is like the perimeter security control of the whole application. The input not only includes data input from users but also covers the parameters passing between function calls, methods, APIs, or systems. The concept of validation covers various kinds of technical approaches:

Techniques	Purpose	Example
Canonicalization Normalization	Process input data into known or expected form.	URL decode/encode File path or names handling
Sanitization	Sanitization is to remove illegal characters or make potentially risky data safe. Always sanitize an output to avoid XSS.	Escape: replace < > ' " & with HTML entities.
Validation	To check if the input is valid or within the constraint data type, length, and so on.	IsAlpha, isCreditCard, isDecimal, isIP

The right order of implementation...