What is validator?
The validator npm package is a library of string validators and sanitizers. It provides a variety of functions to validate and sanitize strings, such as checking if a string is in a certain format (e.g., email, URL) or transforming strings to ensure they are safe for use in different contexts.
What are validator's main functionalities?
Email Validation
Checks if the input string is an email.
const validator = require('validator');
console.log(validator.isEmail('test@example.com')); // true
URL Validation
Checks if the input string is a URL.
const validator = require('validator');
console.log(validator.isURL('https://www.example.com')); // true
Sanitizing Strings
Escapes HTML characters in the input string to prevent XSS attacks.
const validator = require('validator');
console.log(validator.escape('<script>alert("xss")</script>')); // '<script>alert("xss")</script>'
Checking String Length
Checks if the input string's length falls within a specified range.
const validator = require('validator');
console.log(validator.isLength('Hello', {min: 2, max: 10})); // true
Blacklisting Characters
Removes specified characters from the input string.
const validator = require('validator');
console.log(validator.blacklist('abc123', '123')); // 'abc'
Other packages similar to validator
joi
Joi is a powerful schema description language and data validator for JavaScript. It allows for a more detailed and structured validation process compared to validator, including the ability to create custom validation schemas.
yup
Yup is a JavaScript schema builder for value parsing and validation. It uses a schema-based approach similar to Joi and can be integrated with form libraries like Formik. It is more focused on object schema validation.
class-validator
Class-validator works with classes and decorators to validate that the properties of an object conform to specified rules. It is typically used with TypeScript and integrates well with class-based frameworks like TypeORM.
express-validator
Express-validator is a set of express.js middlewares that wraps validator.js functions. It is specifically designed for use with the Express web application framework and allows for easy integration of validation into the request processing pipeline.
validator.js
A library of string validators and sanitizers.
Server-side usage
Install the library with npm install validator
var validator = require('validator');
validator.isEmail('foo@bar.com');
ES6
import validator from 'validator';
Or, import only a subset of the library:
import isEmail from 'validator/lib/isEmail';
Client-side usage
The library can be loaded either as a standalone script, or through an AMD-compatible loader
<script type="text/javascript" src="validator.min.js"></script>
<script type="text/javascript">
validator.isEmail('foo@bar.com');
</script>
The library can also be installed through bower
$ bower install validator-js
Strings only
This library validates and sanitizes strings only.
If you're not sure if your input is a string, coerce it using input + ''
.
Passing anything other than a string is an error.
Validators
- contains(str, seed) - check if the string contains the seed.
- equals(str, comparison) - check if the string matches the comparison.
- isAfter(str [, date]) - check if the string is a date that's after the specified date (defaults to now).
- isAlpha(str [, locale]) - check if the string contains only letters (a-zA-Z). Locale is one of
['ar', 'ar-AE', 'ar-BH', 'ar-DZ', 'ar-EG', 'ar-IQ', 'ar-JO', 'ar-KW', 'ar-LB', 'ar-LY', 'ar-MA', 'ar-QA', 'ar-QM', 'ar-SA', 'ar-SD', 'ar-SY', 'ar-TN', 'ar-YE', 'cs-CZ', 'de-DE', 'en-AU', 'en-GB', 'en-HK', 'en-IN', 'en-NZ', 'en-US', 'en-ZA', 'en-ZM', 'es-ES', 'fr-FR', 'hu-HU', 'nl-NL', 'pl-PL', 'pt-BR', 'pt-PT', 'ru-RU', 'sr-RS', 'sr-RS@latin', 'tr-TR', 'uk-UA']
) and defaults to en-US
. - isAlphanumeric(str [, locale]) - check if the string contains only letters and numbers. Locale is one of
['ar', 'ar-AE', 'ar-BH', 'ar-DZ', 'ar-EG', 'ar-IQ', 'ar-JO', 'ar-KW', 'ar-LB', 'ar-LY', 'ar-MA', 'ar-QA', 'ar-QM', 'ar-SA', 'ar-SD', 'ar-SY', 'ar-TN', 'ar-YE', 'cs-CZ', 'de-DE', 'en-AU', 'en-GB', 'en-HK', 'en-IN', 'en-NZ', 'en-US', 'en-ZA', 'en-ZM', 'es-ES', 'fr-FR', 'fr-BE', 'hu-HU', 'nl-BE', 'nl-NL', 'pl-PL', 'pt-BR', 'pt-PT', 'ru-RU', 'sr-RS', 'sr-RS@latin', 'tr-TR', 'uk-UA']
) and defaults to en-US
. - isAscii(str) - check if the string contains ASCII chars only.
- isBase64(str) - check if a string is base64 encoded.
- isBefore(str [, date]) - check if the string is a date that's before the specified date.
- isBoolean(str) - check if a string is a boolean.
- isByteLength(str, options) - check if the string's length (in bytes) falls in a range.
options
is an object which defaults to {min:0, max: undefined}
. - isCreditCard(str) - check if the string is a credit card.
- isCurrency(str, options) - check if the string is a valid currency amount.
options
is an object which defaults to {symbol: '$', require_symbol: false, allow_space_after_symbol: false, symbol_after_digits: false, allow_negatives: true, parens_for_negatives: false, negative_sign_before_digits: false, negative_sign_after_digits: false, allow_negative_sign_placeholder: false, thousands_separator: ',', decimal_separator: '.', allow_space_after_digits: false }
. - isDataURI(str) - check if the string is a data uri format.
- isDate(str) - check if the string is a date.
- isDecimal(str) - check if the string represents a decimal number, such as 0.1, .3, 1.1, 1.00003, 4.0, etc.
- isDivisibleBy(str, number) - check if the string is a number that's divisible by another.
- isEmail(str [, options]) - check if the string is an email.
options
is an object which defaults to { allow_display_name: false, allow_utf8_local_part: true, require_tld: true }
. If allow_display_name
is set to true, the validator will also match Display Name <email-address>
. If allow_utf8_local_part
is set to false, the validator will not allow any non-English UTF8 character in email address' local part. If require_tld
is set to false, e-mail addresses without having TLD in their domain will also be matched. - isEmpty(str) - check if the string has a length of zero.
- isFQDN(str [, options]) - check if the string is a fully qualified domain name (e.g. domain.com).
options
is an object which defaults to { require_tld: true, allow_underscores: false, allow_trailing_dot: false }
. - isFloat(str [, options]) - check if the string is a float.
options
is an object which can contain the keys min
, max
, gt
, and/or lt
to validate the float is within boundaries (e.g. { min: 7.22, max: 9.55 }
). min
and max
are equivalent to 'greater or equal' and 'less or equal', respectively while gt
and lt
are their strict counterparts. - isFullWidth(str) - check if the string contains any full-width chars.
- isHalfWidth(str) - check if the string contains any half-width chars.
- isHexColor(str) - check if the string is a hexadecimal color.
- isHexadecimal(str) - check if the string is a hexadecimal number.
- isIP(str [, version]) - check if the string is an IP (version 4 or 6).
- isISBN(str [, version]) - check if the string is an ISBN (version 10 or 13).
- isISSN(str [, options]) - check if the string is an ISSN.
options
is an object which defaults to { case_sensitive: false, require_hyphen: false }
. If case_sensitive
is true, ISSNs with a lowercase 'x'
as the check digit are rejected. - isISIN(str) - check if the string is an ISIN (stock/security identifier).
- isISO8601(str) - check if the string is a valid ISO 8601 date.
- isIn(str, values) - check if the string is in a array of allowed values.
- isInt(str [, options]) - check if the string is an integer.
options
is an object which can contain the keys min
and/or max
to check the integer is within boundaries (e.g. { min: 10, max: 99 }
). options
can also contain the key allow_leading_zeroes
, which when set to false will disallow integer values with leading zeroes (e.g. { allow_leading_zeroes: false }
). - isJSON(str) - check if the string is valid JSON (note: uses JSON.parse).
- isLength(str, options) - check if the string's length falls in a range.
options
is an object which defaults to {min:0, max: undefined}
. Note: this function takes into account surrogate pairs. - isLowercase(str) - check if the string is lowercase.
- isMACAddress(str) - check if the string is a MAC address.
- isMD5(str) - check if the string is a MD5 hash.
- isMobilePhone(str, locale) - check if the string is a mobile phone number, (locale is one of
['ar-DZ', 'ar-SA', 'ar-SY', 'cs-CZ', 'de-DE', 'da-DK', 'el-GR', 'en-AU', 'en-GB', 'en-HK', 'en-IN', 'en-NZ', 'en-US', 'en-CA', 'en-ZA', 'en-ZM', 'es-ES', 'fi-FI', 'fr-FR', 'hu-HU', 'it-IT', 'ja-JP', 'ms-MY', 'nb-NO', 'nn-NO', 'pl-PL', 'pt-PT', 'ru-RU', 'sr-RS', 'tr-TR', 'vi-VN', 'zh-CN', 'zh-TW']
). - isMongoId(str) - check if the string is a valid hex-encoded representation of a MongoDB ObjectId.
- isMultibyte(str) - check if the string contains one or more multibyte chars.
- isNumeric(str) - check if the string contains only numbers.
- isSurrogatePair(str) - check if the string contains any surrogate pairs chars.
- isURL(str [, options]) - check if the string is an URL.
options
is an object which defaults to { protocols: ['http','https','ftp'], require_tld: true, require_protocol: false, require_host: true, require_valid_protocol: true, allow_underscores: false, host_whitelist: false, host_blacklist: false, allow_trailing_dot: false, allow_protocol_relative_urls: false }
. - isUUID(str [, version]) - check if the string is a UUID (version 3, 4 or 5).
- isUppercase(str) - check if the string is uppercase.
- isVariableWidth(str) - check if the string contains a mixture of full and half-width chars.
- isWhitelisted(str, chars) - checks characters if they appear in the whitelist.
- matches(str, pattern [, modifiers]) - check if string matches the pattern. Either
matches('foo', /foo/i)
or matches('foo', 'foo', 'i')
.
Sanitizers
- blacklist(input, chars) - remove characters that appear in the blacklist. The characters are used in a RegExp and so you will need to escape some chars, e.g.
blacklist(input, '\\[\\]')
. - escape(input) - replace
<
, >
, &
, '
, "
and /
with HTML entities. - unescape(input) - replaces HTML encoded entities with
<
, >
, &
, '
, "
and /
. - ltrim(input [, chars]) - trim characters from the left-side of the input.
- normalizeEmail(email [, options]) - canonicalizes an email address.
options
is an object with the following keys and default values:
- all_lowercase: true - Transforms the local part (before the @ symbol) of all email addresses to lowercase. Please note that this may violate RFC 5321, which gives providers the possibility to treat the local part of email addresses in a case sensitive way (although in practice most - yet not all - providers don't). The domain part of the email address is always lowercased, as it's case insensitive per RFC 1035.
- gmail_lowercase: true - GMail addresses are known to be case-insensitive, so this switch allows lowercasing them even when all_lowercase is set to false. Please note that when all_lowercase is true, GMail addresses are lowercased regardless of the value of this setting.
- gmail_remove_dots: true: Removes dots from the local part of the email address, as GMail ignores them (e.g. "john.doe" and "johndoe" are considered equal).
- gmail_remove_subaddress: true: Normalizes addresses by removing "sub-addresses", which is the part following a "+" sign (e.g. "foo+bar@gmail.com" becomes "foo@gmail.com").
- gmail_convert_googlemaildotcom: true: Converts addresses with domain @googlemail.com to @gmail.com, as they're equivalent.
- outlookdotcom_lowercase: true - Outlook.com addresses (including Windows Live and Hotmail) are known to be case-insensitive, so this switch allows lowercasing them even when all_lowercase is set to false. Please note that when all_lowercase is true, Outlook.com addresses are lowercased regardless of the value of this setting.
- outlookdotcom_remove_subaddress: true: Normalizes addresses by removing "sub-addresses", which is the part following a "+" sign (e.g. "foo+bar@outlook.com" becomes "foo@outlook.com").
- yahoo_lowercase: true - Yahoo Mail addresses are known to be case-insensitive, so this switch allows lowercasing them even when all_lowercase is set to false. Please note that when all_lowercase is true, Yahoo Mail addresses are lowercased regardless of the value of this setting.
- yahoo_remove_subaddress: true: Normalizes addresses by removing "sub-addresses", which is the part following a "-" sign (e.g. "foo-bar@yahoo.com" becomes "foo@yahoo.com").
- icloud_lowercase: true - iCloud addresses (including MobileMe) are known to be case-insensitive, so this switch allows lowercasing them even when all_lowercase is set to false. Please note that when all_lowercase is true, iCloud addresses are lowercased regardless of the value of this setting.
- icloud_remove_subaddress: true: Normalizes addresses by removing "sub-addresses", which is the part following a "+" sign (e.g. "foo+bar@icloud.com" becomes "foo@icloud.com").
- rtrim(input [, chars]) - trim characters from the right-side of the input.
- stripLow(input [, keep_new_lines]) - remove characters with a numerical value < 32 and 127, mostly control characters. If
keep_new_lines
is true
, newline characters are preserved (\n
and \r
, hex 0xA
and 0xD
). Unicode-safe in JavaScript. - toBoolean(input [, strict]) - convert the input string to a boolean. Everything except for
'0'
, 'false'
and ''
returns true
. In strict mode only '1'
and 'true'
return true
. - toDate(input) - convert the input string to a date, or
null
if the input is not a date. - toFloat(input) - convert the input string to a float, or
NaN
if the input is not a float. - toInt(input [, radix]) - convert the input string to an integer, or
NaN
if the input is not an integer. - trim(input [, chars]) - trim characters (whitespace by default) from both sides of the input.
- whitelist(input, chars) - remove characters that do not appear in the whitelist. The characters are used in a RegExp and so you will need to escape some chars, e.g.
whitelist(input, '\\[\\]')
.
XSS Sanitization
XSS sanitization was removed from the library in 2d5d6999.
For an alternative, have a look at Yahoo's xss-filters library or at DOMPurify.
Tests
$ npm test
Reading
Remember, validating can be troublesome sometimes. See A list of articles about programming assumptions commonly made that aren't true.
License (MIT)
Copyright (c) 2016 Chris O'Hara <cohara87@gmail.com>
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.