You should always validate input to a database. Data ought to be validated at the edge, which in this case is the http endpoints. You should not rely on interna

You should always validate input to a database. Data ought to be validated at the edge, which in this case is the http endpoints. You should not rely on internal services (a database) to do validation One of the dangers in switching to high level languages is that people have lost any sense of data size. In C you almost always specify a max string width because that is the easiest easy to deal with strings. While C has many shortcomings, forcing the responsible programmer to deal with string width is a good thing. Honestly as a stripe user, this sort of unvalidated input terrifies me. Stripe deals with money. All inputs ought to be validated. I figured the company would spend a lot of engineering time making sure data was cleaned and couldn't escape like this. Today it's a string width issue. Tomorrow it's a sql injection. I'm surprised stripe let you publish this.