2

If I have a form, say a simple contact me form with inputs for name, email, message, etc. And I have the form set to submit using Ajax after the JavaScript validation has returned true on all inputs.

Do I still need to validate the inputs using PHP? If JavaScript is turned off, how could the form still submit? And if the form can't submit because the JavaScript is off, how could that cause any harm?

Improve this question
5
  • 1
    what about injections, attacks ??? validate any user data before sending to database Commented Jul 23, 2012 at 8:51
  • 1
    Yes, I know to validate before submitting anything to the DB, but if the PHP script used in the Ajax only sent an email containing the contact me message I wouldn't be submitting anything to the DB. Sorry, I forgot to mention that. Commented Jul 23, 2012 at 8:57
  • you also need to do something for bots, automated scripts that can send form multiple times making your messages going in spam(Blacklist) ..even stack do something for HUMAN/ROBOT VERIFICATION ;) Commented Jul 23, 2012 at 9:00
  • What would you recommend for human/bot verification? Captcha? Something else? Commented Jul 23, 2012 at 9:08
  • You would use a captcha like reCAPTCHA. reCAPTCHA helps to digitize old books at the same time as protecting your website from spam, read more about that on the reCAPTCHA website. Commented Jul 23, 2012 at 9:30

5 Answers 5

Reset to default
4

Of course you need server-side validation! :-)

It's always needed.

Just install this add-on: https://addons.mozilla.org/en-US/firefox/addon/tamper-data/.

It lets you freely modify what goes to the server.

Also, Firebug lets you modify what the browser sees, therefore submits to the server.

Here is an analogy: banks have locks on their safes. But they also have security cameras, and alarm systems, in case the locks fail to stop someone from stealing.

EDIT:

If you are using a contact form (and the script automatically email the person contacting), keep in mind that someone could make your script send 1000's of spam messages, simply by adding addresses to the email field.

To avoid this, you need to do server-side validation. You simply cannot rely on client-side validation.

Improve this answer
Sign up to request clarification or add additional context in comments.

4 Comments

Good call, but wouldn't setting max length on the input tag solve the problem of adding multiple email addresses to the email field?
@Freethinker No way. Firebug and the Web Developer toolbar can easily remove maximum lengths.
O, apparently I had no idea Firebug could screw with the code so much. I'm glad I asked! Thank you for the help.
You're welcome. Just remember for future, the client (possible hacker) can send absolutely anything to your server, even if it means creating their own modified version of Firefox. :-)
2

It's best to do validation at server-side as end-user can do more than just turn on/off JavaScript.

As JavaScript is available at client-side, a malicious user can alter the client-side validation to make malicious inputs pass the client-side validation.

It's always better to trust inputs that are server-side validated than trusting users to not alter JavaScript behavior.

Improve this answer

5 Comments

Thanks for the response. Now please forgive my ignorance but currently I have JS validation on all of my form inputs and identical PHP validation on those same inputs using the same RegExes. Would that be enough validation or should I do something else? Also, I only use PDO for DB submission.
Sounds sufficient for me as long as there are server-side validations.
Good to know. Also, and again I'm still a newb so I apologize for the obvious questions but how could a malicious user alter the client-side validation?
Using tools like Firebug, malicious user can alter JavaScript. For your case, he/she can make it skip client-side validation.
O, I didn't know you could do that. Thank you for the help.
2

You should always use backend validation to sanitise the user input regardless of the presence of front end validation.

While you are correct that the form cannot be submitted with Javascript disabled it could still be submitted by a person with malicious intent by simply sending a POST request to the URL which you use.

Improve this answer

Comments

2

I think it's better to have both validation types, every time: client-side (using JavaScript, so no Ajax call is made to the browser) and server-side (using PHP validations).

The form can still be submitted using the Firebug console or other kind of hacks.

A normal user can't do that but... still. If there's a chance it can be done, you shouldn't risk it.

Improve this answer

Comments

1

Anyone can submit form to your URL with any data. Even from localhost

So server side validation is a must

Improve this answer

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.