可以绕过HTML属性吗？

Question

Suppose I have an <input> tag with a pattern attribute (for example, a pattern that matches some format of a phone number), and I don't go through the standard HTML page in the browser to post that data (for example, through postman), would that data still be check against the regex pattern? In other words, can html attributes (like pattern or require ) be bypassed?

More generally, in terms of security, should server side scripts always check against all possible invalid data?

Answer 1

Yes, you should always validate security sensitive information server-side. Never trust client input or assume it came from your HTML page.

Consider that with the dev tools that come with most popular browsers, these attributes could easily be manually removed from the DOM client side. It wouldn't even require spoofing the entire page.