0

Possible Duplicate:
Validate email address in Javascript?

How do I validate email on the client side using javascript when the server side cannot validate? From my understanding Javascript can be turned off so how can this be achieved and prevent me from receiving PCI warnings?

$(document).ready(function() {

var clearMePrevious = "";

// clear input on focus
$("#email").focus(function() { 
    if($(this).val()==$(this).attr("title")) {
        clearMePrevious = $(this).val();
        $(this).val("");
    }
});

// if field is empty afterward, add text again
$("#email").blur(function() {
    if($(this).val()=="") {
        $(this).val(clearMePrevious);
    }
});

$('#submitemail').click(function() {
    app.ajax.load({
         reqName : 'emailSubmit',
         url: '$httpUrl('Bronto-OptIn')$?email=' + $('#email').val(),
         selector : '#emailbox',
         callback: function(responseText, textStatus) { }
    });
            return false;
});

});

<form id="emailsignup_form" name="emailsignup_form" method="post" action="$httpUrl('Bronto-OptIn', 'fid', 'information')$">
<div class="fl"><input class="email-signup-input" type="text" title="Enter Your Email Address" value="Enter Your Email Address" name="email" id="email" /></div>
<div class="fl"><button class="email-signup-btn" value="Submit" name="submitemail" id="submitemail">Submit</button></div>
<div class="clear">&nbsp;</div>

Community
  • 1
  • 1
Jgunzblazin
  • 137
  • 1
  • 2
  • 11
  • 2
    Why can't the server validate? Client side validation is always insecure, no matter what you do. – elclanrs Dec 27 '12 at 21:08
  • 1
    Don't fully understand your question. You can validate client side using a regular expression (something like **^.+@.+(\..+)+$**). However, you always want to validate the input again on the server in case the user has JavaScript disabled. What does this question have to do with PCI? – Sam Dec 27 '12 at 21:09
  • 1
    Client side validation mostly just gives the user quick feedback and all of the validation has to be redone on the server since the server has to keep its database from getting bad content and protect itself from malicious input. – Lee Meador Dec 27 '12 at 21:11
  • I was recently scanned and flagged for PCI warnings because the email address was not being validated. I have to resolve this to pass PCI. – Jgunzblazin Dec 27 '12 at 21:14
  • You need to validate server-side regardless of how/whether you validate client-side. You should use the same filter client-side that you do server-side to avoid confusion when something passes server-side but not client-side or vice-versa. – Mike Samuel Dec 27 '12 at 21:14
  • According to web service - Server side cannot validate because all of our form is custom except for the email – Jgunzblazin Dec 27 '12 at 21:15
  • @Sam I am not to familiar regex. How would I manipulate the code above to do so? I will have to contact the web service and get more info as to why they can't validate. Thanks everyone for helping me out. – Jgunzblazin Dec 27 '12 at 21:54

1 Answers1

0

If client side validation is necessary I would put in a fallback for the case that javascript is not enabled - 

<script type="javascript">
    /* Wire up form submittal */
</script>
<noscript>
    <p>JavaScript is required to use this form, please enable JavaScript in your browser!</p>
</noscript>

See this - How to detect if JavaScript is disabled?

Community
  • 1
  • 1
cchamberlain
  • 17,444
  • 7
  • 59
  • 72