Hacker News Reader

The thing every developer should have learned from the beginning is to never rely on anything that comes from user input or client

View on HN

I hope no one is relying on it! But in the context of a regular user, maxlength measuring all chars is failsafe (user is allowed to submit a long string that should be caught by validation elsewhere) vs measuring visible chars is faildangerous (user can’t submit a valid string because the front end validation stops them)

Which is weird

At work we almost exclusively use backend validation and return a json object with the fields that failed validation + what rules were failed.

agreed, i discard user input in all of my apps

Reply on news.ycombinator.com