Every input that reaches your server could be wrong, by accident or on purpose. A missing field, a phone number with a letter in it, a negative amount or a huge block of text can crash your code, corrupt your data or, with payments, cost real money. Adverts mention debugging and security alongside APIs because employers have seen what happens without careful validation.
Never trust the client
Your app's form might check inputs, but anyone can send requests straight to your API with a tool like curl, skipping your app entirely. So the server must check everything again. Frontend checks are for convenience; backend checks are for safety.
What to validate
- Presence: required fields are there.
- Type: a quantity is a number, not text.
- Format: a phone number or email has the right shape.
- Range: an amount is above zero and below a sensible limit.
- Length: names and notes have a maximum size.
Ghanaian phone numbers
Local mobile numbers are usually written as 10 digits starting with 0, such as 024 123 4567, or in international form with and the leading 0 dropped. People type them with spaces, dashes or the country code. A good approach is to first, then check: