Implement PipeTransform with string generic types, guard against non-string inputs with a typeof check, and return the sanitized value. Apply at param level for targeted sanitization or at handler level with @UsePipes() for all string arguments of that route.
Always guard non-target types with typeof or metadata.metatype checks — pass them through unchanged.
Use PipeTransform<Input, Output> generics to make the transformation contract explicit.
Param-level application is the most precise — only the targeted argument is processed.
Handler-level @UsePipes() applies to all arguments — useful for bulk sanitization.
Stateless pipes (no injected services) can be used as class references without new.