Do you use both Client-side and Server-side validation techniques side by side when validating input from a user, e.g. via a contact form?
If so, is it really necessary? Are you over engineering?
Yes, and you should.
This is how the ASP.NET Validation Controls work.
It is certainly not over-engineering as using one without the other has drawbacks.
One of the first fundamentals that I learnt about security was that hackers will never use your UI.
Any client side validation can normally be easily bypassed in web apps if they have their own local version of your form and then submit it back to your server.
Client side validation is great though for improving your user experience and reducing unnecessary round trips to the server to perform validation.
Front-end validation can give immediate feedback if it's a rich interface.
Server side validation should be the bare minimum.
And for input that is likely to be wrong, you should also add a client side check..
For example: check if the email is correctly formatted on both the client and server side but checking if it's unique could be a server side check.
Yes, It's not a bad idea to use both. If simple user input errors can be caught on client side then it makes sense to tell user about those errors before sending data and bugging down your server. For example if user entered something that does not look like an email address in the 'email' field or entered a string of only 5 chars long in the password field and you know your site required the password to be at least 6 chars long, then you should tell the user about it before sending anything to the server.
2) User maliciously tried to bypass your client-side validation, which is really easy.
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site.
Would you like to answer one of these unanswered questions instead?