依赖HTML'required'进行简单的表单验证

Question

My question is simple, I'm writing a simple login/registration form for my website using HTML, PHP and jQuery.

Is it neccesary to write the form validation in PHP also when I could use HTML-s required tag on each input and use PHP to check for username availability and password match?

I believe it is good practice to also have a validation in the back-end but it would appear that the 'required' function in HTML takes care of all that? Can this be misused easily, what are the general drawbacks of solely relying on HTML for simple form validation?

Answer 1

Is it neccesary to write the form validation in PHP also

You can never depend on any form of client side validation. It can always be bypassed.

People might be using browsers that don't support HTML 5 validation attributes, or might use a DOM inspector to remove them.

JavaScript solutions can be trivialy bypassed by turning off JavaScript.

Forms can be copy/pasted, edited and then submitted from a page owned by the user.

HTTP requests can be constructed by hand without going near a form.

etc. etc.

Client side validation can only ever be provided for the convenience of the user. The protection of your systems can only be handled server side.