Home/ Questions/Q 523163
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T08:25:45+00:00

I’m biased towards writing fool-proof applications. For example with PHP site, I validate all

  • 0

I’m biased towards writing fool-proof applications. For example with PHP site, I validate all the inputs from client-side using JS. On the server-side I validate again. On both sides I do validation for emptiness, and other patterns (email, phone, url, number, etc). And then I strip malicious tags or characters, trim them (server-side). Later I convert the input into desired formats/data types (string, int, float, etc). If the library meant for server-side only, I even give developers chances for graceful degradation and accommodate the tolerate the worst inputs and normalize to the acceptable ones (I have predefined set of the acceptable ones).

Now I’m reading a library that I wrote one and a half years ago. I’m wondering if developers are so evil or lack IQ for me do so much of graceful degradation, finding every possible chance to make the dudes right, even they gave crappy input which seriously harms performance. Or shall I do minimal checking and expect developers to be able and are willfully to give proper input? I have no hope for end-users but should I trust developers more and give them application/library with better performance?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Common policy is to validate on the server anything sent from the client because you can’t be totally sure it really was your client that sent it. You don’t want to “trust developers more” and in the process find that you’ve “trusted hackers of your site more”.

    Fixing invalid input automatically can be as much a curse as a blessing — you’ve essentially committed to accepting the invalid input as a valid part of your protocol (ie, in a future version if you make a change that will break the invalid input that you were correcting, it is no longer backwards compatible with the client code that has been written). In extremis, you might paint yourself into a corner that way. Also, invalid calls tend to propagate to new code — people often copy-and-paste example code and then modify it to meet their needs. If they’ve copied bad code that you’ve been correcting at the server, you might find you start getting proportionally more and more bad data coming in, as well as confusing new programmers who think “that just doesn’t look like it should be right, but it’s the example everyone is using — maybe I don’t understand this after all”.

    • 0