Favorite Web Form Validation Technique

Question

What is everyone's favorite way to sanitize user data?

I've been using Javascript, but have recently required something more secure (people can turn it off, after all), so I was looking at Flex, but thought I'd ask the community what they thought.

Answer 1

It's recommended to use both server- and client-side validation. I use JQuery for client side validation.

Answer 2

NEVER NEVER NEVER use javascript or any other client-side technology for the only validation. You can use client-side validation to save some load on your server or make your app seem more responsive by showing the error sooner when validation fails, but you should always validate using server-side code.

Personally, I like the ASP.Net validation controls because it gives you the benefit of client-side validation with security of server-side, without having to write your logic twice. Of course, the stock controls are pretty bare, but you can extend them.

Answer 3

Depending on the requirements of your project you may or may not want to implement client-side validation. However, server-side validation should ALWAYS be implemented. I prefer to white-list appropriate inputs and values as opposed to black-listing invalid data because this ensures that no one will ever slip something by that I failed to consider.

Answer 4

Validation should ALWAYS be done server-side. Doing it client-side, in addition, is fine.

How you do it depends on what your app is written in. Any language should be able to handle validation; the logic used is what matters, not the language.

It also depends on what you're doing with the data you're given. Putting it in a URL or storing it in a SQL database requires two very different kinds of sanitization. If at all possible, white-list valid values--don't black-list invalid values. Someone will always be able to come up with a new mal-input you hadn't considered.

Answer 5

• always use server side validation at the very least
• use regular expressions

PHP Example:

preg_match('/^[\w][\w\,\-\.]*\@[\w]+[\w\-\.]*$/', $_GET['email'], $matches);
if (count($matches) > 0) {
  $_GET['email'] = $matches[0];
} else {
  die('invalid email address');
}