Skip to main content

UnsanitizedString

UnsanitizedString passes through values without any sanitization. Use ONLY for fields that:

  • Are validated with @validate directives (passwords, emails, tokens, UUIDs)
  • Should not have HTML entities escaped (URLs, technical identifiers)
  • Are system-generated or come from trusted sources

NEVER use for user-provided text that will be displayed without validation.

Example: password: UnsanitizedString! @validate(constraint: "password") email: UnsanitizedString! @validate(constraint: "email") token: UnsanitizedString! @validate(constraint: "uuid")

scalar UnsanitizedString