This is more of an opinion based general programming question than specific to prisma. Which do you usually do. Do you have the front-end send back a perfectly build up prisma object and just pass it to 

.create(

 or do you have the back-end build it up? Say for example you want to create a user with posts do you send back- in the body- an object that's prisma specific looking like this...

{
  data: {
    email: '<mailto:emma@prisma.io|emma@prisma.io>',
    posts: {
      create: [
        {
          title: 'My first post',
          categories: {
            connectOrCreate: [
              {
                create: { name: 'Introductions' },
                where: {
                  name: 'Introductions',
                },
              },
            ],
          },
        },
        {
          title: 'How to make cookies',
          categories: {
            connectOrCreate: [
              {
                create: { name: 'Social' },
                where: {
                  name: 'Social',
                },
              },
            ],
          },
        },
      ],
    },
  },
}

And just dump the prebuilt object into...

const { id } = await prisma.user.create({
        data: req.body,
      });

Or do you send back something less prisma specific like this...

data: {
    email: '<mailto:emma@prisma.io|emma@prisma.io>',
    posts:
      [
        {
          title: 'My first post',
          categories: [
            {
              name: 'Introductions',
            },
          ],
        },
        {
          title: 'How to make cookies',
          categories:
            [
              {
                name: 'Social',
              },
            ],
        },
      ],
  },

And then build it up before passing it to the 

prisma.user.create

 method?

await prisma.user.create({
        data: req.body,
      });

That is very dangerous. You always want to validate all data that will go into the DB.

Thank you. I plan to validate. On a side note, what would be an example of something that can occur that's very dangerous?

await prisma.user.create({
        data: req.body,
      });

where

req.body

has

req.body.roles = ["admin"]

, for example

Thanks