Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Do you use both Client-side and Server-side validation techniques side by side when validating input from a user, e.g. via a contact form?

If so, is it really necessary? Are you over engineering?

share|improve this question
This is interesting:… – TeaDrinkingGeek Mar 1 '11 at 11:44
up vote 26 down vote accepted

Yes, and you should.

This maintains instant user feedback without wasted postbacks whilst also guarding against users disabling JavaScript.

This is how the ASP.NET Validation Controls work.

It is certainly not over-engineering as using one without the other has drawbacks.

share|improve this answer
+1. No excuse for not having server side validation imo. – G3D Mar 1 '11 at 11:26
Server side is necessary, client side is convenience. In web applications you can't count on client side validation. – BillThor Mar 1 '11 at 15:58
@BillThor - Yup thats exactly right – billy.bob Mar 1 '11 at 16:00

One of the first fundamentals that I learnt about security was that hackers will never use your UI.

Any client side validation can normally be easily bypassed in web apps if they have their own local version of your form and then submit it back to your server.

Client side validation is great though for improving your user experience and reducing unnecessary round trips to the server to perform validation.

share|improve this answer
+1, I've seen to many examples where validation was done entirely on the client side – Karl Mar 1 '11 at 14:16

If so, is it really necessary?


Are you over engineering?


Front-end validation can give immediate feedback if it's a rich interface.

Back-end can be used by multiple front-ends. And it's the only validation for the HTML-only (no javascript) fall-back plan.

share|improve this answer

Server side validation should be the bare minimum.

And for input that is likely to be wrong, you should also add a client side check..

For example: check if the email is correctly formatted on both the client and server side but checking if it's unique could be a server side check.

share|improve this answer
"Checking it's unqiue" is verification NOT validation so this doesn't apply. Understand the difference. – billy.bob Mar 1 '11 at 11:37
Did you even read what you post? Checking that email is unique is validation. Cheking, say, that email and password are valid credentials is verification. In any case, it is just a terminology issue. – Andrea Mar 1 '11 at 13:57

Yes, It's not a bad idea to use both. If simple user input errors can be caught on client side then it makes sense to tell user about those errors before sending data and bugging down your server. For example if user entered something that does not look like an email address in the 'email' field or entered a string of only 5 chars long in the password field and you know your site required the password to be at least 6 chars long, then you should tell the user about it before sending anything to the server.

It's important to also duplicate exact same validation on the server for 2 reasons: 1) what if user has Javascript disabled?

2) User maliciously tried to bypass your client-side validation, which is really easy.

share|improve this answer
Great answer thanks. – TeaDrinkingGeek Mar 1 '11 at 15:17

protected by gnat Nov 18 '15 at 9:08

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.