好吧，我还是可以回答的。

除了Rob和Nathan的回答，我还想补充一点，客户端验证很重要。当你在你的web表单上应用验证时，你必须遵循以下准则:

客户端

必须使用客户端验证，以过滤来自您网站的真实用户的真实请求。 应该使用客户端验证来减少在服务器端处理期间可能发生的错误。 应该使用客户端验证来最小化服务器端往返，从而节省带宽和每个用户的请求。

服务器端

You SHOULD NOT assume the validation successfully done at client side is 100% perfect. No matter even if it serves less than 50 users. You never know which of your user/emplyee turn into an "evil" and do some harmful activity knowing you dont have proper validations in place. Even if its perfect in terms of validating email address, phone numbers or checking some valid inputs it might contain very harmful data. Which needs to be filtered at server-side no matter if its correct or incorrect. If client-side validation is bypassed, your server-side validations comes to rescue you from any potential damage to your server-side processing. In recent times, we have already heard lot of stories of SQL Injections and other sort of techniques that might be applied in order to gain some evil benefits.

Both types of validations play important roles in their respective scope but the most strongest is the server-side. If you receive 10k users at a single point of time then you would definitely end up filtering the number of requests coming to your webserver. If you find there was a single mistake like invalid email address then they post back the form again and ask your user to correct it which will definitely eat your server resources and bandwidth. So better you apply javascript validation. If javascript is disabled then your server side validation will come to rescue and i bet only a few users might have accidentlly disable it since 99.99% of websites use javascript and its already enabled by default in all modern browsers.

好吧，我还是可以回答的。

除了Rob和Nathan的回答，我还想补充一点，客户端验证很重要。当你在你的web表单上应用验证时，你必须遵循以下准则:

客户端

必须使用客户端验证，以过滤来自您网站的真实用户的真实请求。 应该使用客户端验证来减少在服务器端处理期间可能发生的错误。 应该使用客户端验证来最小化服务器端往返，从而节省带宽和每个用户的请求。

服务器端

You SHOULD NOT assume the validation successfully done at client side is 100% perfect. No matter even if it serves less than 50 users. You never know which of your user/emplyee turn into an "evil" and do some harmful activity knowing you dont have proper validations in place. Even if its perfect in terms of validating email address, phone numbers or checking some valid inputs it might contain very harmful data. Which needs to be filtered at server-side no matter if its correct or incorrect. If client-side validation is bypassed, your server-side validations comes to rescue you from any potential damage to your server-side processing. In recent times, we have already heard lot of stories of SQL Injections and other sort of techniques that might be applied in order to gain some evil benefits.

Both types of validations play important roles in their respective scope but the most strongest is the server-side. If you receive 10k users at a single point of time then you would definitely end up filtering the number of requests coming to your webserver. If you find there was a single mistake like invalid email address then they post back the form again and ask your user to correct it which will definitely eat your server resources and bandwidth. So better you apply javascript validation. If javascript is disabled then your server side validation will come to rescue and i bet only a few users might have accidentlly disable it since 99.99% of websites use javascript and its already enabled by default in all modern browsers.

是的，总是可以完全绕过客户端验证。您需要做到这两点:客户端提供更好的用户体验，服务器端确保您得到的输入是实际验证的，而不仅仅是客户端假定的验证。

我将建议实现客户端和服务器验证，它使项目更安全......如果我必须选择一个，我会选择服务器端验证。

你可以在这里找到一些相关信息 https://web.archive.org/web/20131210085944/http://www.webexpertlabs.com/server-side-form-validation-using-regular-expression/

必须始终在服务器上进行验证。

在客户端上进行验证对用户来说也很好，但这是完全不安全的。

我再重复一遍，因为这很重要:

始终在服务器上验证

并添加JavaScript用于用户响应。