Originally posted by TheDefender
I personally only do server side verification (Not a fan of JavaScript), The best part is that i have a function I wrote, and it is easily changable for its use in various scripts.
I do as much validation as possible in JS and then redo all that work, plus some more in PHP.
Why?
Well for a number of reasons.
1) It takes 0 more programming time. I have already written a library of php and a library of javascript functions and written a php page that interfaces with a db table which contains my validation information for my fields so all the js & php calls are handled by this script and it only takes me a couple seconds to configure this table. BTW: the php validation script also draws my html form. It can even handle referential integrity for foreign keys.
2) Most user's don't even know what javascript is let alone that they can turn it off. Therefor most users will benefit from the javascript validation of not having to perform a page load, matter of fact if I choose to they can't even leave the field until the validation is completed.
3) If they have javascript off then they have to wait for a page load, big deal - it's not worth making everyone wait.
4) Personally when I use an online form I prefer ones that use javascript validation because then I don't have to wait for a page load - which even on my cable connection can take time.
5) Only doing frontend (JS) validation is risky because the user can turn JS off. Only doing backend (PHP) validation is risky cause if someone has to wait for a page load to find they have an error they are more likely to abandon the process. However, if I do it in both places I am not taking any risks.
6) My JS library is less then 5k, so almost no load time involved with it. Every site that uses it loads it from a common location on my server, whcih means that if I fix a bug in my JS or PHP libraries I only have to fix it in one place and it is fixed everywhere I use them. Also, this allows for optimal use of browser caching of my JS since it can use the same chached file for a bunch of different forms.