客户端验证和Ajax请求

Question

I think the only advantage of client side validations is they prevent pages from being reloaded.

Say I have an ajax function to send a request to a php file. The server performs validation and if some errors are found, returns them to the client. The ajax that receives the error messages would then output them to the browser.

I've read that some people also perform client side validation before it gets submitted by ajax. Why is this necessary if I can return data from the server without reloading? Isn't ajax enough?

Answer 1

In the Client Side Validation you can provide a better user experience by responding quickly at the browser level. When you perform a Client Side Validation, all the user inputs validated in the user's browser itself. Client Side validation does not require a round trip to the server, so the network traffic which will help your server perform better. This type of validation is done on the browser side using script languages such as JavaScript, VBScript or HTML5 attributes.

For example, if the user enter an invalid email format, you can show an error messeage immediately before the user move to the next field, so the user can correct every field before they submit the form.

Mostly the Client Side Validation depends on the JavaScript Language, so if users turn JavaScript off, it can easilly bypass and submit dangerous input to the server . So the Client Side Validation can not protect your application from malicious attacks on your server resources and databases.

As both the validation methods have their own significances, it is recommended that the Server side validation is more SECURE!

Answer 2

Ajax is enough but say you have a large form with large piece of content that it's gonna post, and if there is an issue it will fail to submit after the server serves your request and validation. It's a waste of server resources I think. So in this case it's better to add some client side validations.

Answer 3

Not necessary but it has professional advantages:

• User friendliness:

  • The user gets warned immediately without reloading
  • The user is familiar with his own browser and the way it notifies him about each field

• Other advantages:

  • No extra server page load
  • You can use the :invalid css (and re-use it on server page invalid validation)
  • You can minimize your server invalid response code, since all the checks the client can do, don't have to be re-notified (as user friendly).

Though ALWAYS do a server validation as hackers, tweakers and API users can get around client validation.