Server - side validation

[Dragomirc]

User can modify the validation javascript locally (save the page and do anything with it) or javascript can be turned off in browser. So in this case client-side validation is useless. Hence, you should verify on server too

Client side validation is a plus, but You MUST use server side validation as well, because when you're accepting user information, you should always treat is as "hostile". If that data also gets fed into a database, ssv is your last line of defense because you don't want junk or invalid data in your database.

Client side validation is not bullet proof(javascript might be disabled), and therefore if something gets validated on client side, that doesn't mean it'll be valid when it arrives to your server.

Forgot to mention that you can reuse your logic from the clientside validation for your server side validation