How to validate Forms in PHP

Question

Is it better to validate PHP forms using php and then redirecting with errors, or is it better to use javascript validation and then just allow form submission if javascript is enabled.

Answer 1

You must validate values on the server side, since the client cannot be trusted.

You may validate values on the client side to provide better UX for those with JavaScript enabled.

Answer 2

I usually do both. If you can check the fields in javascript, it saves them the loading time and spares your server the hit. You still have to check again on the server in case they had javascript disabled, or intentionally bypassed it.