Search code examples
validationserver-sideclient-side-validation

Why is client-side validation not enough?

I saw here that:

As you probably already know, relying on client-side validation alone is a very bad idea. Always perform appropriate server-side validation as well.

Could you explain why server-side validation is a must?

Solution

  • Client-side validation - I assume you are talking about web pages here - relies on JavaScript.

    JavaScript powered validation can be turned off in the user's browser, fail due to a scripting error, or be maliciously circumvented without much effort.

    Also, the whole process of form submission can be faked.

    Therefore, there is never a guarantee that what arrives server side, is clean and safe data.