Javascript or PHP validation?

[ATLien]

I am doing some form validation on my new site, and so far I have done php validation, but I was thinking of doing javascript to save the load time that comes with the php validation.

Do you think javascript form validation is enought, or would you suggest I do both just incase users disable javascript?

[JamieJelly]

what kind of form fields are you validating?

You could use some DOM scripting and validate on the fly for fields such as valid telephone numbers, post (zip) codes, email addresses which would really be the most useful of javascript implementations, coupled with PHP validation for those with js disabled or unavailable.

[kyleposey]

Unless you are doing some really complex PHP coding, or doing some File I/O, there shouldn't be any load time difference.

However, not having any server-side validation will open you up to automatic bot submissions, and user errors for users that disable javascript.

[ATLien]

As of right now, I have a form with image verification for bot prevention, and php server side validation. I am going to add javascript verification to make the validation alittle more understandable for the non computer savy users.

[kyleposey]

Why not just display the error messages with PHP? Then the user can see the error messages and take them into consideration while they are filling out the form.

[LazyJim]

I use JS but still have PHP backup

Need JS?
JS enables validation-as-you-type and other tricks with the potential to enhance the user experience. However you must be careful to ensure you only help and don't hinder!

Need PHP?
It depends how important the validation step is - as in what are the consequences of invalid or malicious data entry?
In most cases PHP validation will be required, you can incorporate this into any data processing steps you have in the PHP page if you think it will help speed it up.
Don't be tempted to use generic error messages, be as helpful as possible.

So in summary
In terms of power and flexibility, JavaScript has the best potential for helping users fill in forms (correctly). But PHP verification is usually required regardless
Remember any 'hacker' could POST any name=value data to any script, it's not limited to the form input elements and you can't rely on disabled/hidden input elements not being modified either.

[veridicus]

You need to use PHP validation if you want to ensure good input data. It's the only way to properly validate.

You can use JS validation for usability. For example, you can check password length right after the user types it in for a quick message. But you still need to check the input in PHP because bots and others can easily bypass the JS.

[kyleposey]

(you guys forgot that he has image verification to thwart off bots...but good points nonetheless)

[ATLien]

I think I am just going to go full up with both php and javascript. I am also looking into some Ajax verification tools too. So we will see how it goes.

[MrMean]

Although I should practice what I preech I would recommend using both. Several reasons for this.

The benifit of JS validation is its "on the page" therefore it does save the user pressing the dreaded back button and loosing what they've just typed out, in most cases anyway.

However using JS alone is a security risk to your website. You don't want people posting any & everything surely! It would be easy to flood submissions without PHP Authentication.

[kyleposey]

In an elegant PHP solution, the user never has to hit the back button, is displayed helpful error messages, and has the form pre-filled with the previously submitted values.

[ATLien]

That is how I do it. I list the errors on the form, with with the submitted data already filled in excluding the password, I unset that.

[Lev]

I think PHP validation is really best because some people have javascript disabled. If you are doing something fairly complex, then you can use both.

[kenkam]

I agree with LazyJim.

If you had JS on your site I could disable it on my browser and happily POST to your application.

JS is there to help the user. It is intended to give the client a richer interface. Some nice pointers to make it more user-friendly. You definately should not use it for validation if it is anything slightly more than trivial. PHP validations makes sure that it is probably done. There's no client-side validation that is secure. It is all server-side that does the best work in validation.

Summary - if the data more than trivial - use server side validation (PHP)

[explicitzone.com]

PHP

[Izzmo]

Both, it is always good to be using both, just in case one doesn't work.

With most Ajax applications, if the user has disabled Javascript, then sometimes the PHP script will not work properly. That's the only problem I have, but then again, I just use them both whether the user has JS enabled or not.

[Paul M]

You must do php validation on the server side, whether you use JS as well on the clientside is personal choice. Relying on clientside validation only would be asking for serious trouble.

[Izzmo]

Ahh.. you make some good points Paul

w00t - You are over 100 posts (finally)

[gastongr]

JavaScript is good to speed up the process but it should always be backed with server side validation as it's easy to bypass.

[Hades]

Hi!

I personally prefer PHP, since the validation is running on the server side and the program behaviour cannot be modified by a third party.

But if you are working in PHP with frameworks, or even an automatic script to build forms that you have written, you can easily validate using both PHP and JS, and do not have to bother on how to write the code for each one.

I usually write an array of required fields and some business rules, then call to a FormHelper class which creates the form and its validation. I suggest you to try that.