用于表单验证的HTML5“必需”属性：好主意或坏主意

Question

I am using the simplest of HTML 5 forms, and wish to use the 'required' attribute for the checkbox to make sure the user clicks it when submitting the form.

Should I have some server side validation - in case somebody is using a browser that doesn't support html5?

More Information:

My form looks like this:

[] I accept the terms and conditions

Submit

Code:

<input type="checkbox" required> I accept the terms and conditions<br />
<input type="submit" value="submit"/>

Answer 1

Client-side form validation is a good way for enhancing user experience, it also provides some styling that can help to communicate that an input is required.

But you will allways still have to validate any data submitted on the server, making sure is clean and safe data. The required attribute can be manipulated by a malicious user.

Answer 2

Actually required CSS pseudo class is supported by all browser (no ok, IE8 excluded), as you can see here

http://caniuse.com/#search=form%20validation

Anyway, you ALWAYS need a server side validation, because client side checked data must be considered unsafe regardless.

Answer 3

永远不要相信客户端的任何数据（无论是HTML还是JS，都可以更改。客户端验证只是为了获得更好的用户体验。真正的安全性在于服务器端。

Answer 4

It is not enough to save your logic behind the UI. Some HTML form validation dose not work in some browsers . So server side validation is MUST!