Possible Duplicate:
JavaScript: client-side vs. server-side validation
I am a beginner in PHP web application development. I have recently developed a web application that is used in an intranet, and there are about 25 users using the system. All the HTML forms within the system are validated using JavaScript and a jQuery library and the client machines are JavaScript enabled. Is it necessary to validate each form on the server again or is JavaScript validation is enough.
Put simply, JS validation is not enough. A user can very easily disable JS on their client, and bypass your validation. Even if you are submitting user data using AJAX (thus requiring JS to be enabled), a clever user can easily construct their own HTTP request to your server, again bypassing your validation.
To this end, if you want to completely ensure that all data entered into your system is validated, it will have to be done on the server.