FrançaisGet started

Form validation

Validating on the client for comfort and on the server for security, validation rules, sending the form back with its errors and values, and redirecting after a successful submission.

  • 24 cards
  • 5 topics
  • Free
Study this deck

The outline, topic by topic

Each topic is weighted the way the exam weighs it.

  1. Concepts
  2. Questions
  3. Sort and link
  4. Scenarios
  5. Understand

A few cards from the deck

  • Server-side validation: what is it?

    Show the answer

    A check of the data received, made by the application before using or storing it, whatever tool sent it.

    The server cannot trust the browser: a script or curl sends whatever it wants. It is the only check that really protects the data.

  • The server validates a postcode with this pattern. Which input does it wrongly accept?

    ```javascript
    /[0-9]{5}/.test(saisie)
    `

    • ab75011cd
    • 7501
    • 750 11
    • 7501A
    Show the answer

    ab75011cd

    Without ^ or $, the pattern looks for five consecutive digits anywhere in the text, and 75011 is in there. The other three inputs never have five digits in a row. The right pattern is /^[0-9]{5}$/.

  • The browser checks a field thanks to HTML5 attributes: required, type='email', min, max and ….

    Show the answer

    The browser checks a field thanks to HTML5 attributes: required, type='email', min, max and pattern.

    The field <input name='cp' pattern='[0-9]{5}'> blocks submission if the input is not made of five digits. The browser anchors the pattern by itself.

  • Client-side validation: what is it?

    Show the answer

    A check made in the browser, by HTML5 attributes or JavaScript, before the form is even sent.

    It gives an immediate answer and saves a round trip. But the user can get around it, so it never replaces the server's check.

  • An order with a negative price reaches the database, although the HTML field has min='0'. What is the cause and the fix?

    • required was missing: the browser ignores min without it
    • The database accepts anything; the column type must be changed
    • The browser misbehaved; it needs updating
    • The form was bypassed; revalidate on the server
    Show the answer

    The form was bypassed; revalidate on the server

    min only acts in the browser, when the user clicks the submit button, and needs no required once a value is entered. A script or curl writes the POST request itself, with no check at all. The server must refuse any negative price.

Study this deck