Input Validation

Learn input validation through an executable example, then connect the small demonstration to production code.

Validate data at trust boundaries: parse syntax, normalize when appropriate, enforce length limits and check business constraints. Validation should reject bad data without exposing sensitive internal details.

This example checks a username with Unicode-aware rune counts and keeps both success and error handling explicit.

Follow this diagram before executing the example. Check where a value or decision changes what runs next.

This example is a complete program. Save it as main.go or paste it into the Go Playground.

Go code

package main

import (
	"fmt"
	"strings"
	"unicode/utf8"
)

func validateName(raw string) (string, error) {
	name := strings.TrimSpace(raw)
	if n := utf8.RuneCountInString(name); n < 3 || n > 20 {
		return "", fmt.Errorf("name must have 3–20 characters")
	}
	return name, nil
}
func main() {
	for _, s := range []string{" Li ", " Maya "} {
		v, err := validateName(s)
		fmt.Printf("%q -> %q, %v\n", s, v, err)
	}
}

Output

" Li " -> "", name must have 3–20 characters
" Maya " -> "Maya", <nil>

Li is too short after trimming, so the validation returns an error; Maya passes and is returned without surrounding spaces.

• A rune count is not always equal to the number of user-perceived grapheme clusters.
• Do not rely on frontend-only validation; apply server-side checks.

Add a rule that rejects control characters, and test several Unicode names.

Tip: Edit the example above, predict the output, and run the modified code to test your reasoning.

You have practiced Input Validation in a small, self-contained program. The important habit is to predict what runs, inspect the actual output and distinguish the language rule from the particular example.

Before continuing, make sure you can explain the program to someone who has not seen it, including the line that changes its result.