3

I have a lengthy form which heavily uses client-side validation (written in jQuery). To prevent users with disabled JavaScript submitting the form, I have included a hidden field which is populated with "javascript_enabled" value by jQuery. If JS is disabled in the browser, then the filed is left blank and the form will not be submitted.

The question is - is this enough and I should feel safe, or do I have to include a server side validation for every field too?

Eleeist
  • 6,891
  • 10
  • 50
  • 77
  • possible duplicate of http://stackoverflow.com/questions/162159/javascript-client-side-vs-server-side-validation – kapa May 05 '12 at 10:03

4 Answers4

8

No. Client side validation is only here for the comfort of the user, not to protect your server.

All client side actions are easy for the user to change.

To protect your server you MUST add server side validation.

Denys Séguret
  • 372,613
  • 87
  • 782
  • 758
6

To what extent? None. You should never rely on client-side validation at all. Client-side validation is purely for UX purposes.

The true validation is always done on the server.

Joseph
  • 117,725
  • 30
  • 181
  • 234
4

All of the above answers are valid, I just want to add a couple of points.

Client Side

  • Client-side validation can be used to give instantaneous feedback to the user without the need for additional requests to the server (Lower Traffic).

  • Client-side validation can be easily bypassed. (Disable JavaScript, Custom HTTP Requests, Access using e.g. CURL)

Server Side

  • Can not be bypassed (Unless you've left an exploitable piece of code)

  • Good server side validation can prevent potential threats such as XSS, and SQL Injection. (Can lead to obtaining other users data, or break your database)

How I believe this will change

I'm looking forward to further development of the WebSocket protocol and for it to become more widely used.. WebSockets allow for a two way (full duplex) connection, meaning it will be incredibly efficent to validate from the server-side for example every time a key is entered into an input field. Hopefully this approach will do away with client-side validation!

Jack
  • 15,614
  • 19
  • 67
  • 92
  • I use websockets a lot, for their performances and the comfort they provide. But I'm doubtful about their use in simple form validation : with ajax today a validation including a round-trip is fast enough (less than 100 ms) if you use server side the kind of technology you'd use for websockets. I agree with your other points. – Denys Séguret May 05 '12 at 10:29
  • I agree on any average web application AJAX is fine, WebSockets will only show an advantage on a much larger scale due to their smaller overhead. – Jack May 05 '12 at 10:33
0

Server side validation is a must, client side validation is to do as much as is practical without the overhead of a round trip to the server.

Tony Hopkinson
  • 20,172
  • 3
  • 31
  • 39