0

I have a form like this:

<form id="loginForm" action="register.php" method="post" onsubmit="return validateForm();">
    <p>Register:</p>
        <p style="text-align: left;">Full name: <br><input type="text" name="name" required/></p>
        <p style="text-align: left;">Email: <br><input id="email" type="text" name="email" onkeyup="validateEmail(value);"required/></p>
      <span id="emailError" style="display:none;border:1px solid red;">Please enter a valid email</span>
        <p style="text-align: left;">Username: <br><input id="username" type="text" name="username" onkeyup="validateUsername(value);" required/></p>
        <span id="usernameError" style="display:none;border:1px solid red;">Username can only contain a-z, 0-9 and must be at least 6 characters long</span>
        <span id="usernameTaken" style="display:none;border:1px solid red;">Username taken</span>
        <p style="text-align: left;">Password: <br><input id="password" type="password" name="password" onkeyup="validatePassword(value);" required/></p>
        <span id="passwordError" style="display:none;border:1px solid red;">Password requires one lower case letter, one upper case letter, one digit,no spaces and  6-13 length</span>
        <input type="submit" value="Register">
    </form>

The validateForm() function only returns "true" if all of the fields have been validated. BUT.

I noticed that this could be bypassed by simply "Inspecting the element" in for example Firefox or Google Chrome and changing "onsubmit="return validateForm();" to "onsubmit="true;". And the form will be submitted, even though the fields have not been validated.

How do i prevent this?

Thank you!

Mads Nielsen
  • 106
  • 1
  • 5
  • 14
  • 3
    _How do i prevent this_ Server side validation – baao Mar 07 '16 at 14:32
  • 2
    Never trust Javascript validations as they can be deactivated.... Always add server side validations – cl3m Mar 07 '16 at 14:33
  • You prevent bypassing of validation in general by having validation in the client and on the server, you can't prevent bypassing in the client (at least not with methods that make sense or are worth it) but you're solid if you do your duties on the server. – Jonast92 Mar 07 '16 at 14:36
  • 1
    http://stackoverflow.com/questions/15855770/why-do-we-need-both-client-side-and-server-side-validation – Hamza Zafeer Mar 07 '16 at 14:37
  • You'll be completely in shock once somebody tells you about `curl`... Learn a bit more about HTTP, it's the protocol underlying all this and not understanding its client-server architecture is a mistake. – deceze Mar 07 '16 at 14:37

2 Answers2

0

Server side validation.

Client side validation is important in terms of good UX, and to prevent unnecessary trip to the server.

BUT

Client side validation is in NO WAY replacement for good server side validation. The client side code (javascript) eventually runs on the user's machine, and everyone can very easily tweak and change it.

Ronen Cypis
  • 21,182
  • 1
  • 20
  • 25
0

You just don't want to trust only the javascript validation. You have to validate that on the server as well and maybe even harder. The javascript side is only a bonus for the user, so they can get an instant notice about a wrong input instead of a long server communication after sending the form.

TL;DR The behaviour is totally fine and you have to validate the input on your server.

nemoinho
  • 604
  • 4
  • 15