Comments on: Unobtrusive PHP ?

By: norman784

norman784 — Wed, 13 May 2009 15:34:47 +0000

But, the problem, if I have understand is, the HTMl can be changed with tools like firebug, and the validation will no longer secure

regards

By: Niels Bom

Niels Bom — Wed, 18 Feb 2009 17:03:38 +0000

Well the problem you’re trying to tackle is (imho) defining in only one location what a certain form element is supposed to deliver. And what validation rules it has to obey.

My suggestion: hang it all on the input name ‘email’. You can easily attach jQuery to that form element, don’t need a class for that.

Do the JS validation through AJAX and call the same serverside function to evaluate the validity of the emailadress. Then when the form is really submitted to the server the contents of the emailfield go through the same function.

By: david

david — Wed, 04 Feb 2009 09:14:02 +0000

How would you add multiple rules?

This is also a security hole because a hacker only needs to change the fieldname to bypass validation rules. For js validation it doesn’t matter because it’s backed up by serverside validation.

Another thing to keep in mind is that is you process the value using another (POST) variable you still have to return it to the original value in case of errors in the validation