Menu
Community /Pin to ProfileBookmark
@NogDogAug 24.2006 — #Just a note, be careful about using empty() to validate fields if 0 (zero) is a valid entry, as empty() will return TRUE for a variable with a value of 0. In that case, you should do something like:
@NogDogAug 24.2006 — #
I think we are in agreement here, I just want to clarify:
The only problem with using client-side validation is if you depend on it and do not re-check on the server. There is a small percentage of users who have Javascript disabled on their browsers. Whether this is due to security concerns or ignorance (they don't even realize they disabled it), we as developers cannot simply dismiss such users as not being worth our time. Therefore, your form processing needs to work irregardless of whether the form inputs have been validated by the client or not.
Using client-side validation [i]will[/i] give the majority of users faster feedback and reduce some of the network/server load, so it's fine to use it for that reason. Just do not assume on the server side that such validation has occurred, or you may "shoot yourself in the foot" by processing invalid form inputs if you don't re-check them there. (Or for that matter, malicious users could submit their own post data, completely bypassing your form and any input validation it does.)
doesn´t verify blank fields in form
Hi! I have a problem! The system I work with is a Fedora with MySql and Php 4. In the application there is a FORM to introduce data in the DDBB, and there are some obligatory fields, so there is a typical JS function that, on submit and before saving the information with other php script, it checks if there are any blank fields and shows a typical error message. This was working correctly until some collateral efects appeared after changing some SQL querys. The problem now is that anyone can save the information with all the mandatory fields left blank. And this is not the expected behaviour… I’ve been checking all the code and making some changes during the last month but I can´t get the solution. It is not neccesary to say that I am not an experienced developer … So I am asking for some help please, because I am desperated for a solution… Maybe this has happened to someone before? … or is a typical error? Or maybe someone know other solutions or debuging methods to focus the problem? Thanks in advance!
Sign in
to post a comment10 Comments(s) ↴
0
@NogDogAug 24.2006 — #Just a note, be careful about using empty() to validate fields if 0 (zero) is a valid entry, as empty() will return TRUE for a variable with a value of 0. In that case, you should do something like:[code=php]
if(!isset($_POST['fieldname']) or trim($_POST['fieldname']) === "")
{
// field is empty (note use of "===" operator instead of "=="
}
[/code]0
@NogDogAug 24.2006 — #You really believe that theirs no benefit to validating a form before it is presented to the server? what if your a busy server, that will create an overhead that is nothing more tha ntime / money waster, yes validate Client-Side, it saves on resources, why waste valuable resources, bandwidth as not all hiosts give unlimited bandwidth, so in some situations where traffic is a consideration and part of the projects design spec, you would benefit from freeing up bandwidth by doing checks client side.
WHEN the form is posted, sure validate further to ensure that the attempt to post is not a hijack or code injection to thwart any server hijack / break in.
Simply to dismiss client-side is shooting yourself in the foot, most good site designs will employ client-side validation to ensure that data meets a minimum criteria, server-side simply re-enforvces your policy with allot more control for you.
The two go hand in hand m8ty.[/QUOTE]
I think we are in agreement here, I just want to clarify:
The only problem with using client-side validation is if you depend on it and do not re-check on the server. There is a small percentage of users who have Javascript disabled on their browsers. Whether this is due to security concerns or ignorance (they don't even realize they disabled it), we as developers cannot simply dismiss such users as not being worth our time. Therefore, your form processing needs to work irregardless of whether the form inputs have been validated by the client or not.
Using client-side validation [i]will[/i] give the majority of users faster feedback and reduce some of the network/server load, so it's fine to use it for that reason. Just do not assume on the server side that such validation has occurred, or you may "shoot yourself in the foot" by processing invalid form inputs if you don't re-check them there. (Or for that matter, malicious users could submit their own post data, completely bypassing your form and any input validation it does.)