I am working on a lightning component which is a simple form that takes from, to emails and a message body as user input and passes this data to an apex controller.

enter image description here

Apex Controller

public with sharing class MessageController
    public static void send(String toEmail, String fromEmail, String messageBody)

        // create a single email message
        Messaging.SingleEmailMessage myEmail = new SingleEmailMessage();
        // populate myEmail with data
        // .... skipped for brevity

        catch (Exception ex)
            throw new AuraHandledException('Message send error: ' + ex.getMessage());    

I am using a custom SendService which provides messaging services and performs other logic before actual sending. This service will be reused in multiple places.


Where should I validate input data, namely these values (String toEmail, String fromEmail, String messageBody) and what validations do I need?

Everything that comes from UI is not secure and needs to be validated and sanitized. My question is when/where and how?


  1. Logically validation of the fromEmail parameter can be performed right in the send method of the apex controller. But this approach introduces code duplication. If I create another apex class SendSeveral.cls that would allow to send several messages to a list of records, it might have this method public static void send(List<String> recipientIds, String fromEmail, String messageBody).

This tells that we can move validation to the SendService level. But in case of SendSeveral.cls it might be wise to stop the execution if fromEmail is null and not even go further to SendService


  1. This actually leads to the how part. Maybe it is reasonable to perform basic checks for input (not blank, null, empty) directly in the controller. And if everything looks good, proceed to SendService which in turn performs domain logic checks: fromEmail is actually of the email address type, etc.

Does anybody know best practices of input validation?

this is what I've found so far:

  1. Validate a form with Apex and server side controller
  2. Where should data validation occur?
  • ¯_(ツ)_/¯ – Martin Lezer Apr 12 '19 at 8:51
  • @MartinLezer, that's why I am asking this question. What is the best practice? Having checks in both places, fine. Is there a pattern for this kind of logic. I believe there should be. – Eduard Apr 12 '19 at 9:20
  • 1
    Validating emails is a fool's errand. Even if you do manage to validate the format (not as trivial a task as you might think), the "valid" email may not correspond to any inbox. – Adrian Larson Apr 12 '19 at 19:01
  • @AdrianLarson, I couldn't agree more with you regarding emails validation. My question, however, is about general approach towards validating inputs from UI on the server. I gave emails just for example, it could be any other user-provider fields. How and where should a developer validate and sanitize data that comes from UI? Should it first check that required inputs are not null in the controller, and perform business logic checks in the deeper layers of the application? – Eduard Apr 14 '19 at 8:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.