For any "human" data: trim and escape, and you're done. If you want to validate it, just ask the party that knows for sure (send an email, run a transaction, vi

For any "human" data: trim and escape, and you're done. If you want to validate it, just ask the party that knows for sure (send an email, run a transaction, visit the URL). This includes names, addresses, phone numbers, emails, URLs, CC/account numbers, user names, passwords (maybe tell them that caps-lock is on or any other weird keyboard state if you can).