DEV Community

Discussion on: Input Validation: Client-side or Server-side?

ramesh profile image
Ramesh Elaiyavalli

Both. Always.

Client-side: Do it early and do it with usability. (e.g) Phone number field has the right format depending on the country and area code.

Server-side. Do it ALWAYS. Never trust the client. Client could be a browser, mobile app, or API client. For the phone number provided, validate for format but more importantly check against blocked number database, spam numbers or send an OTP - whatever the biz logic is.