All user input is untrusted and may be malicious, so validate it before processing to prevent vulnerabilities and crashes.

Validation process:

1. Check if required parameters exist
2. Validate parameter content (type, format, range)
3. Return error response (400 Bad Request) if invalid
4. Only process if all validation passes

Example:

let error = null;

// 1a. Check existence
if (!('currency' in req.query)) {
    error = "Parameter 'currency' not set";
}
// 1b. Validate content
else if (req.query.currency !== 'CHF' && req.query.currency !== 'EUR') {
    error = "Invalid value for parameter 'currency'";
}

// 2. Abort on error
if (error) {
    res.status(400);
    res.send(error);
    return;
}

// 3. Process valid input
res.send('Processing with currency: ' + req.query.currency);

Note: Also validate request body and cookies - all user input is untrusted!

Writing a tag and a class with no space between them (p.intro) means "AND": the rule matches only elements that are both that tag and have that class.

This narrows a rule so it fires only when several conditions hold at once. Glue the parts together with no whitespace:

p.einleitung {
    font-weight: bold;
}

That matches <p class="einleitung"> but not <div class="einleitung"> and not a <p> without the class. The space is the key: no space means "the same element must satisfy all parts"; a space would mean a descendant relationship instead (covered in the combinators card), which is a completely different thing.

The same "AND" logic chains further:

/* element + id: a <div> that also has id="header" */
div#header { background: navy; }

/* two classes: an element carrying BOTH btn and primary */
.btn.primary { background: blue; }   /* matches <button class="btn primary"> */

A practical use is styling one tag's variant without affecting other tags that happen to share the class — p.note styles note paragraphs while leaving <div class="note"> alone.