Don't forget

Good article.

First, let me say that I like using JavaScript when I can - it saves doing the round trip to the server, and thus speeds up applications.

HOWEVER, the big drawback with only relying on JavaScript for your form validation is that, because the validation is done on the client side (rather than the server side), you can never trust that any data that is submitted to the server has been validated. Any malicious user could create a dummy copy of your page, and submit any values to the server that are not what you might have otherwise expected. Worse - you might assume that the user input was valid (even though it wasn't) and as a result not bother to validate it on the server side.

The bottom line is that, although JavaScript allows you to do some neat things on the client side, it cannot remove the need to re-validate input to the server prior to processing. To do so is lulling yourself into a false sense of security, and asking for trouble.

Hope this helps.