Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

On software company websites I visit the first time, I often open the "Contact us" page and try to submit the contact form with all fields empty. I am just curios if they validate the user input.

If it is just submitted or only validated poorly (e.g. only Javascript validation), I often hear myself thinking

Oh, look how sloppy they are! Can't even validate user input. That calls itself a software company? No, I don't think I want to buy any software services of them.

A friend of mine has such a "sloppy" contact form. You can submit a completely empty form. I asked him why he does not validate user input, and he said:

Look, I want that customers can contact me. They should enter any information they want. If they only want to enter a message and leave the other fields empty, why should I care? They enter the relevant information anyway. I do not want to add any barriers when contacting me.

I did not ask him how many empty messages he gets, though.

However, what is the better option now? Both arguments (check how company handles user input vs. not adding any barriers in contacting) seem to make sense for me.

I want that the user can easily contact me, but still has the impression that I am precise when programming webpages.

share|improve this question

4 Answers 4

up vote 4 down vote accepted

From UX point of view

and try to submit the contact form with all fields empty
[...]
If they only want to enter a message and leave the other fields empty, why should I care?

You and your friend are not talking about the same scenarios.

Letting the user submit all fields empty on a contact form is a mistake, because there are no valid cases where the customer would be contacting you while saying nothing. If he has nothing to say, why is he submitting a form?

The only possible scenario where the customer actually submits an empty contact form is that he pressed Enter by mistake when the focus was on a single-line text field (or he pressed by mistake the submit button).

Validation, at this level, at least client-side one, is a must-have and has a specific purpose. If a customer is submitting an empty contact form, he should be notified that something is wrong and the submission should be prevented.

Making all field mandatory on a contact form is not a solution neither. When I want to tell someone that there is a typo on the home page of their website, I don't want to think about the subject of the message, I don't want to give my email address, I don't want to give my phone number, and I don't want to specify the name of my girlfriend, because, damn it, all I want is to tell is that there is a typo.

From technical point of view

Processing submitted contact forms is a complicated task which requires lots of time. Filtering technically the submissions you don't need improves productivity of the person in charge of reading those messages.

There is no need to display the empty messages in the administration panel. I would even say that messages with a length inferior to, say, ten characters, are useless, and shouldn't be displayed neither.

On the other hand, doing validation response properly is a difficult task: you have to implement validation itself both server-side and optionally client-side, and respond properly with a (often) localized error message or a cleaner, more UX-oriented way.

For the sake of simplicity and given the specificity of the case, I wouldn't do any server-side validation response, only client-side. If the user with no JavaScript wants to submit an empty contact form, that's fine: administrators will never see those submissions, but the customer will be convinced that the form was submitted successfully. This case is too specific (i.e. the user doesn't have JavaScript, makes a mistake when submitting a form and this mistake doesn't affect the system) to handle specifically.

share|improve this answer
1  
From the security standpoint, all user input should be validated server-side. You never know which part of the automatic message pipeline is prone to injection/buffer overflows etc. –  Deer Hunter Jul 4 '13 at 7:37
    
@DeerHunter: +1, my answer wasn't clear. I talked exclusively about the case where all inputs are empty. Indeed, server-side validation is required for all input. –  MainMa Jul 4 '13 at 7:49
    
Server-side validation is necessary to prevent data pollution, but from a security standpoint, very rudimentary validation is enough: making sure that very large input is discarded as early as possible to reduce the attack surface for DoS, and rate-limiting + CAPTCHA checks to prevent spamming, brute-forcing and DoS attacks is about as wild as it gets. What you absolutely do want though is to convert data to the correct format whenever it crosses a layer boundary (database <-> logic or logic <-> presentation). But that's not validation. –  tdammers Jul 4 '13 at 7:57

Validation is important for two reasons:

  1. If you don't have any validation, you may end up with your database/inbox full of useless messages (Messages that have no content or messages whose sender info is missing or makes no sense).

  2. SQL injection. Not having any validation may compromise your database.

However:

No. 1 may not be an issue if, like your friend, you don't mind getting some fields empty.

No. 2 may not be an issue if you don't save the data from the form to a database (I've seen contact forms that use the data to send an email to the company's support department without ever storing them in a database, for example.)

So the answer here is (as it is so many times): It is good practice, but depends on the particulars of the project.

share|improve this answer

Depends on the requirements. In general, you should strike a balance between no and too much validation. I would validate on fields that are required to be meaningful all the time, like phone numbers, email addresses and the like. Free text fields are of course free of validation. I would say not validating on empty forms is a waste of round-trip and storage (if it does get saved!). One thing you should consider for contact forms as with all input is validating/sanitizing against cross-site scripting.

share|improve this answer
    
Well, if you make a homepage for yourself, you can decide the requirements. The "waste of roundtrip time and storage" is not my concern. I want that the user can easily contact me, but still has the impression that I am precise when programming webpages. –  Uooo Jul 4 '13 at 6:38
    
Right. That's why it really depends on the requirement. Balance usability and accuracy depending on needs. –  raymond Jul 4 '13 at 8:05

You should validate your form before user submission .Because if you did'nt validate the fields properly user can submit empty forms without any data .

share|improve this answer
    
That does not answer my question. XSS is not an issue here. –  Uooo Jul 4 '13 at 7:33
    
Validation does not prevent XSS. Correct output encoding does. –  tdammers Jul 4 '13 at 7:53

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.