[matthewkayin]

You first ask if you really need to.

[AnimalMuppet]

Unless you're exposing it to the internet, ever, in the entire future history of the program. Then you kind of have to, in one form or another.

[Someone]

You have to, but you probably shouldn’t do it by trying to add the inputs. That opens a door for DDOS attacks.

Returning an error on inputs that are too long (for some definition of it) is the way to go.