Every input is guilty until checked.
Anything a user can type, upload or send can be wrong, huge or hostile. Check it on the server, every time, before you use it.
Check Five Things
Type
A number is a number, a date is a date.
Length
Names under 100 characters, not 10 million.
Format
SA ID is 13 digits; email looks like email.
Range
Leave days between 0.5 and 30.
Files
Check type and size; never trust the name.
Three habits
Allow what's valid. Don't just block what's bad.
Use safe database queries, never text glued together.
Escape anything you show back on a page.
Source: MyBroadband ↗
Allow what's valid. Check it on the server. Every time.