Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

Do you use both Client-side and Server-side validation techniques side by side when validating input from a user, e.g. via a contact form?

If so, is it really necessary? Are you over engineering?

Regards TDG

share|improve this question
    
This is interesting: smashingmagazine.com/2009/07/07/… –  TeaDrinkingGeek Mar 1 '11 at 11:44

5 Answers 5

up vote 23 down vote accepted

Yes, and you should.

This maintains instant user feedback without wasted postbacks whilst also guarding against users disabling JavaScript.

This is how the ASP.NET Validation Controls work.

It is certainly not over-engineering as using one without the other has drawbacks.

share|improve this answer
6  
+1. No excuse for not having server side validation imo. –  G3D Mar 1 '11 at 11:26
4  
Server side is necessary, client side is convenience. In web applications you can't count on client side validation. –  BillThor Mar 1 '11 at 15:58
    
@BillThor - Yup thats exactly right –  billy.bob Mar 1 '11 at 16:00

Yes, It's not a bad idea to use both. If simple user input errors can be caught on client side then it makes sense to tell user about those errors before sending data and bugging down your server. For example if user entered something that does not look like an email address in the 'email' field or entered a string of only 5 chars long in the password field and you know your site required the password to be at least 6 chars long, then you should tell the user about it before sending anything to the server.

It's important to also duplicate exact same validation on the server for 2 reasons: 1) what if user has Javascript disabled?

2) User maliciously tried to bypass your client-side validation, which is really easy.

share|improve this answer
    
Great answer thanks. –  TeaDrinkingGeek Mar 1 '11 at 15:17

One of the first fundamentals that I learnt about security was that hackers will never use your UI.

Any client side validation can normally be easily bypassed in web apps if they have their own local version of your form and then submit it back to your server.

Client side validation is great though for improving your user experience and reducing unnecessary round trips to the server to perform validation.

share|improve this answer
    
+1, I've seen to many examples where validation was done entirely on the client side –  Karl Mar 1 '11 at 14:16

If so, is it really necessary?

Yes.

Are you over engineering?

No.

Front-end validation can give immediate feedback if it's a rich interface.

Back-end can be used by multiple front-ends. And it's the only validation for the HTML-only (no javascript) fall-back plan.

share|improve this answer

Server side validation should be the bare minimum.

And for input that is likely to be wrong, you should also add a client side check..

For example: check if the email is correctly formatted on both the client and server side but checking if it's unique could be a server side check.

share|improve this answer
1  
"Checking it's unqiue" is verification NOT validation so this doesn't apply. Understand the difference. –  billy.bob Mar 1 '11 at 11:37
2  
Did you even read what you post? Checking that email is unique is validation. Cheking, say, that email and password are valid credentials is verification. In any case, it is just a terminology issue. –  Andrea Mar 1 '11 at 13:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.