Hacker News Reader

Comment by BonsaiDen | Hacker News Reader

Another great quote from w3schools:

> JavaScript can be used to validate data - A JavaScript can be used to validate form data before it is submitted to a server. This saves the server from extra processing

Sure! Always trust the client :)

View on HN

I haven't seen the context of the original quote, but what you've quoted here is a valid statement and doesn't really have anything to do with what you're saying.

I'm in no way advocating client-side-only validation, but form validation on the client side to clean up mistakes can save a server round trip and a page reload, and so could save server side processing.

EDIT: just to clarify, I don't mean to turn this into a discussion with further nitpicking. I just thought your quote and comment were representative of some of the W3Fools content; picking a quote and interpreting it to mean what you want it to mean, and then criticizing it on that basis.

It only is a valid statement if you add the notes about always doing the validation server side too, and only using the JS one for improve UX.

But w3schools is read by beginners, they don't have any clue about web security whatsoever, if you don't tell them everything they will just go with the few things that you've told them.

That's the entire relevant context of the quote. It occurs in a list of what JavaScript is good for, and that's one of the items, with no further clarification. It definitely implies (though it doesn't explicitly require) client-only validation, since it talks about saving the server from having to do "extra processing" without qualification.

Reply on news.ycombinator.com