Over the last couple of weeks I have had various discussions about validation. It seems some people involved in a web development project, over look what is to me a fundamental part of any kind of data submission.
Its seems that quite a few websites are being complacent about their validation for data submission. Some relying on only a captcha which doesn’t validate any of the other data submitted. Even worse some are relying on a JavaScript alone!!
To points really about this, generally the data you are wanting to collect from your user is specific data not rubbish so therefore measures needs to be taken to control what data the user submits. For example if you want the user to give their phone number in a specific format or you want your user to give you their email address, you are going to want the email address in the correct format. The second point is security, you don’t want users submitting sql injections or JavaScript in your forms, so these as also needs to validated against.
Both these things can be done on both the server side and client side. Rather than thinking either or, think both. Client side validation should be used as convenience to tell the user they have made a mistake in their form without taking your form on a round trip to the server. However client side validation wont help with security for the simple reason that JavaScript can be turned off! It also runs on the client not on the server so that limits your control. Sever side validation should be the more robust part of your validation strategy this should be used to check for security issues as well rechecking what the client side as already done.
Simple stuff really but you will be surprised how often it is being overlooked!
