Server Side/Client Side or Both User Input Validation

What is the best way to use validation on your site when I want to give people client side “helper” validation such as password not long enough, email is incorrect format but also do server side validation and return errors such as username already exists and have both client and server validation messages visually be displayed the same to the user with the minimal amount of duplication.

Answers:

Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.

Method 1

Client validation can be circumvented easily. You should always validate sensitive data on server, regardless of client validation. Validating them on client too is just a matter of improved user experience.

BTW, ASP.NET validation controls do both.

Method 2

The best hybrid solution is generally to centralize your validation server-side and rely on client-side calls to the server-side stuff. This has a number of advantages:

• You’ll only write validation code once, on the server.
• Client-side validation can be circumvented, but it doesn’t matter; the server is checking everything anyway.
• You get an improved user experience at no or little additional development cost.

The primary disadvantage is that you pay twice as much for validation processing, but that’s not too harsh.

Method 3

You cannot be sure if anything like client-side validation really occurred. If javascript is not available on client side (no-script or disabled JavaScript) it never runs. On post back before any further processing you should call validate method on page using following code:

if(!IsValid)
{
    //inform your user about error(s)
    return;
}

//do further processing

if you have validation groups then you can call validate method with group name:

if!(Validate("groupName"))
{
    //inform your user about error(s)
    return;
}

//do further processing

Method 4

The best way would be to use the ASP.NET validation controls to present the simple ‘hints’ as the client (as mentioned by Mehrdad these will provide client and server side validation) and then use CustomValidators for the elements that need server interactions such as verifying usernames, etc.

All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0