Server Side/Client Side or Both User Input Validation

Question

What is the best way to use validation on your site when I want to give people client side "helper" validation such as password not long enough, email is incorrect format but also do server side validation and return errors such as username already exists and have both client and server validation messages visually be displayed the same to the user with the minimal amount of duplication.

Answer 1

Client validation can be circumvented easily. You should always validate sensitive data on server, regardless of client validation. Validating them on client too is just a matter of improved user experience.

BTW, ASP.NET validation controls do both.

Answer 2

You cannot be sure if anything like client-side validation really occurred. If javascript is not available on client side (no-script or disabled JavaScript) it never runs. On post back before any further processing you should call validate method on page using following code:

if(!IsValid)
{
    //inform your user about error(s)
    return;
}

//do further processing

if you have validation groups then you can call validate method with group name:

if!(Validate("groupName"))
{
    //inform your user about error(s)
    return;
}

//do further processing

---

Answer 3

The best hybrid solution is generally to centralize your validation server-side and rely on client-side calls to the server-side stuff. This has a number of advantages:

• You'll only write validation code once, on the server.
• Client-side validation can be circumvented, but it doesn't matter; the server is checking everything anyway.
• You get an improved user experience at no or little additional development cost.

The primary disadvantage is that you pay twice as much for validation processing, but that's not too harsh.

Answer 4

The best way would be to use the ASP.NET validation controls to present the simple 'hints' as the client (as mentioned by Mehrdad these will provide client and server side validation) and then use CustomValidators for the elements that need server interactions such as verifying usernames, etc.