0

i'm wondering why i have to validate forms on client side while they anyway need a server side (ajax) validation for not being hacked?

IS there any benefit on having both client side and server side (ajax) form validations?

I mean they do the same thing but ajax takes 300ms and client takes 0ms probably, is this a really good reason why to make a duplicated validation? :P

Plus, using a single server side validation you remove not needed js from client side, i see only benefits in having only ajax validation, what about you?

If i'll go for a client side validation, is there some way/practice/logic to follow to not duplicate validation on server side ? Like ONLY if client side validation is ok server performs the action/request ?

Actually my logic is :

Server + Client side validation less requests -> more code (duplicated) -> more troubles -> better UX Server side validation (only ajax) more requests -> less code -> less troubles -> probably same UX !?

Sorry for maccheronic english asd :D

Improve this question
7
  • 1
    This (implementation) question has been answered extensively in stackoverflow, also see this blog post.
    – Izhaki
    Jan 31, 2014 at 11:45
  • It's not really a UX question. The user doesn't care if it's client-side or server-side, they just want to get on with the form and be told if it has errors or not, and how to address them.
    – JonW ♦
    Jan 31, 2014 at 13:01
  • @JonW totally wrong, if user is using a gps connection or slow connection for examlple, the client side makes the difference for UX
    – itsme
    Jan 31, 2014 at 13:46
  • @Sbaaaaaang: Yes, the connection speed makes a difference to UX, but users don't care why it's slow. If someone complains that 'my app is slow when I'm on the train' and you say 'that's because of server-side validation' they'll likely say "what does that mean?", not "well it should be client-side validation". The fact that it is slow is the UX aspect, how you address that is an implementation issue, not a UX one.
    – JonW ♦
    Jan 31, 2014 at 13:50
  • @JonW you missing the point imho, if you have slow connections you won't stay 3 hours to get a validation back from server, you just want to make all in 1 request, so client side validates and server side pushes, done :) (only in case of slow connection)
    – itsme
    Jan 31, 2014 at 14:00

2 Answers 2

Reset to default
5

The answer is to validate in each tier so that you always ensure data integrity. This protects you against the scenario where any of the prior tier validations were skipped.

I can't stand when developers build methods that assume the data has already be validated.

Let's take the following scenario where your tiers are:

  • Client
  • Server
  • Service
  • Database

The user fills out form data on Client. Client sends data to Server. Server sends data to Service. Service sends data to Database. Database sends response to Service and so on all the way back down to the Client.

When a developer assumes the above scenario is the only way each part will be called and they only validate say, on the Client or Server, that's when problems will occur.

What if you have a different method on the Server or Service that calls that same method. It didn't originate from the Client validated form, so where was the validation? Nowhere.

Or say you have a Database stored procedure that's called from another stored procedure. Again, it didn't originate from a Client validated form, so where was the validation? Nowhere.

Not only that, but each tier could have different validations as well. Some tiers validate required fields, some tiers validate business rules, etc.

So, the answer is to validate in each tier so that you always ensure data integrity.

Improve this answer
5
  • i agree, i just don't like duplicated code :D
    – itsme
    Jan 30, 2014 at 16:05
  • 1
    @Sbaaaaaang - Well, it's not really duplicated. Each tier might have some of the same validations, but the code is not duplicated.
    – Code Maverick
    Jan 30, 2014 at 16:07
  • 1
    eheheh i need to watch that like this yeah :D
    – itsme
    Jan 30, 2014 at 16:12
  • 1
    Agree that this is not at all duplicate code. Code Maverick's point of "data integrity" is spot on. For client side, always remember that the user may not have JavaScript turned on (or it may not be supported).
    – Nicholas Pappas
    Jan 30, 2014 at 16:41
  • 1
    +1, a perfect application of Postel's law (en.wikipedia.org/wiki/Robustness_principle). Your layer n shouldn't only accept pre-validated input from layer n+1 and crash if it gets malformed input. Each layer should be prepared to accept malformed input, check it for wellformedness, and handle errors gracefully.
    – Rumi P.
    Jan 30, 2014 at 19:41
3

IS there any benefit on having both client side and server side (ajax) form validations?

From a UX perspective, the benefit is that it's faster for the user.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.