Search code examples
phphtmlrequired

Can I trust that "required" input elements have values submitted?

Can I trust the required attribute for my fields in a form?

<input type="text" name="username" required/>

The above code will ensure that it is a required field, but couldn't the user just inspect element and remove the attribute? Is it necessary that I check if (isset($_POST... or can I rely on the required attribute to do it's thing?

Solution

  • Always use server side validation. The required attribute exists on the front end and can be easily manipulated if a malicious user wishes to modify the DOM.