Question

I have a question about where to put the logic between jquery and php. I´m writing a small website where users can input different values. Those values are added together and multiplied with an value saved in a mysql database and outputed again to the user.

My question is whats the better way for doing this.

A:
Let Jquery serialize the form and send all values to php.
Php catches the Post vars and the value from the database,
calculates everything, writes the sum to the database and
gives everything back to the user.

B:
When the User starts the Script the value of the Database is send from PHP
to the User Form. Now Jquery does all calculations. When everything is ready,
the Sum is send back to PHP and written in the Database.

The reason why I´m asking is A: seems to be safer with the validation of given values. But B: is more frindly to the server. (Jquery ajax is fired on Keyup, means the value would be queried from the database everytime the user edits the form.)

regards,

toni

Answer 1

You should never trust the client. Always validate on the server, even if you do it on the client.

Validating on the client makes a better user experience because it does not require a trip to the server.

Validating on the server ensures the user has not tampered with the data.

In short: do both.