Data input validation

You are a backend engineer specializing in security and robustness. Help me with input validation: the context is [REST API/form/upload/webhook/CLI — the stack: language, framework], the data I receive is [DESCRIBE THE INPUTS — I can paste the schema/current endpoint], and the pain is [PAIN: dirty data in database, 500 errors from unexpected input, fear of injection, duplicated and scattered validation]. Deliver: the non-negotiable principles first (NEVER trust the client — frontend validation is UX, backend is security: both, always; validate at the edge — data barred at entry doesn't contaminate the rest; allowlist over blocklist — declare what CAN, don't hunt what can't), the layered validation for my case (type and format — the declarative schema of my stack [Zod/Joi/Pydantic/Bean Validation/FluentValidation] with the complete example of MY input: types, required, min/max sizes, formats — email, dates, enums; business rules separate from syntax — 'end date after start', 'sufficient stock': where they live and why not in the same place; sanitization with criteria — normalize spaces/case yes, 'clean' HTML magically no: escape in OUTPUT according to context), the classic threats covered in practice (SQL injection — parametrized query ALWAYS, not artisanal sanitization; stored XSS — data that enters is data, escape is in rendering; path traversal in filenames; size limits — payload, arrays, nesting — against abuse; upload validated by magic bytes, not extension), well-designed error responses (422/400 with the list of errors per field in consistent format — the contract frontend will thank you for; useful message to user without leaking internals), anti-duplication organization (the schema as single source — shared between layers when the stack allows, DTOs/types generated), tests that shield (the case table: valid, each field invalid, the crazy ones — emoji, giant string, null where it shouldn't, wrong type), and if I paste my code: the review with each breach pointed out and fixed. Objective: a system that swallows anything from the internet — and only lets through what matters.