# Input Validation & Sanitization {#input-validation--sanitization}


How Gauzy validates and sanitizes all incoming data.


## Validation Pipeline {#validation-pipeline}






```mermaid
graph LR
    A[Request Body] --> B[Validation Pipe]
    B --> C{Valid?}
    C -->|Yes| D[Controller]
    C -->|No| E[400 Bad Request]
```






## class-validator DTOs {#class-validator-dtos}


All input is validated using DTOs with `class-validator` decorators:

```typescript
import { IsString, IsOptional, IsUUID, IsEnum } from "class-validator";

export class CreateTaskDTO {
  @IsString()
  title: string;

  @IsOptional()
  @IsString()
  description?: string;

  @IsUUID()
  projectId: string;

  @IsEnum(TaskStatusEnum)
  status: TaskStatusEnum;
}
```


## Validation Pipe {#validation-pipe}


Applied via the `@UseValidationPipe()` decorator:

```typescript
@Post('/')
@UseValidationPipe({ whitelist: true })
async create(@Body() entity: CreateTaskDTO) { ... }
```


### Options {#options}


| Option                 | Description                        |
| ---------------------- | ---------------------------------- |
| `whitelist`            | Strip properties not in the DTO    |
| `transform`            | Auto-transform to DTO types        |
| `forbidNonWhitelisted` | Throw error for unknown properties |


## UUID Validation {#uuid-validation}


All ID parameters are validated with `UUIDValidationPipe`:

```typescript
@Get('/:id')
async findById(@Param('id', UUIDValidationPipe) id: string) { ... }
```


## Query Parameter Validation {#query-parameter-validation}


Query parameters use `ParseJsonPipe` and `BaseQueryDTO`:

```typescript
@Get('/')
@UseValidationPipe()
async findAll(@Query() params: BaseQueryDTO<Task>) { ... }
```


## SQL Injection Prevention {#sql-injection-prevention}


TypeORM and MikroORM both use parameterized queries, preventing SQL injection:

```typescript
// ✅ SAFE: Parameterized
this.repository.findOne({ where: { id } });

// ❌ UNSAFE: String interpolation
this.repository.query(`SELECT * FROM task WHERE id = '${id}'`);
```


## Related Pages {#related-pages}


- [API Security Best Practices](https://sourcey-gauzy.pages.dev/security/api-security-best-practices/index.md) — security overview
- [File Upload Security](https://sourcey-gauzy.pages.dev/security/file-upload-security/index.md) — file validation