| Client-side and server-side form validation both have pros and cons and are both valid ways to make sure you only accept form information that is appropriate for the underlying database. Client-side validation utilizes the user's browser to do the validation, thus reducing the load on server resources. It also results in fewer round trips between the server and the client. The down side of client-side validation is that you usually have to use some other scripting language like JavaScript to create the form validation function. Even if you use <CFFORM>, ColdFusion is just creating the JavaScript for you. The problem with this is that different browser versions might implement JavaScript commands slightly differently, and some users might disable JavaScript support entirely. In either scenario, if the browser comes across some JavaScript that it does not understand, it will just ignore it altogether, in which case none of your validation routines will run and inappropriate data might be sent to your server. With server-side validation, you have more control over the validation environment and do not have to worry about browser compatibility issues. The down side of server-side validation lies in the fact that the user must send the information to the server to be checked. If the information does not pass the validation checks, the server sends an error message back to the user, who has to change the information in the form and resubmit it, starting the whole process over again. This can result in many additional round trips between the server and the browser, increasing the workload on the server and chewing up bandwidth. So, which should you use? Well, the answer is simply that it's a good idea to use both. If the client-side validation gets ignored by the user's browser for some reason, you still have the server-side validation to play gatekeeper and reject any inappropriate information. |