Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTML Form Validation is underused

expressionstatement.com

Post reply on HN
Print view View original

61–70 of 343 posts

Re: HTML Form Validation is underused

#61

Post by mcflubbins »

gunalx wrote: post #23

I do get the point of using form validation clientside to ensure a better ui. But dont remenber to also verify serverside. Anything clientside can have been fumbeled with. (Also kinda anoying to have to duplicate this tho)

> Also kinda anoying to have to duplicate this tho

Oh yes it is...

I once worked on a project where we had a tool that dynamically built client-side forms based on each customer's needs. After rolling it out for a big customer I discovered (after the original engineer responsible had already been fired for other reasons) that all of our dynamic forms had NO server side validation. none, zilch, nada.

We did have client side validation though, a good amount of it and nearly all of it was using native HTML features, and we had the whole form available server-side as well. So given that I was under a crunch, on form submission I loaded the HTML form server-side, manually iterated over all the elements and re-implemented the validation checks that were embedded in the HTML. Crazy times, but heck it was flexible!

Re: HTML Form Validation is underused

#62

Post by doytch »

hn_throwaway_99 wrote: post #49
Jerrrrrrry wrote: post #37

Earlier quoted context omitted.

True, but if there's a communication bug between UX and back-end teams, that can escalate into a false sense of security and then an exploit.

You were being downvoted here, but I think you make a great point. The problem with having separate client-side and server-side validation logic is that you (generally) want the rules to be the same, but you end up needing to write them twice, usually in completely different technologies. I have seen many, many cases where the client-side validation and server-side validation got out of sync, and then just like you p…

This was one of the biggest "oh shit" moments I had when learning Remix: I could reuse the same validators across front and backend and they could even be right there in the same file.

Re: HTML Form Validation is underused

#63

Post by blackoil »

Jerrrrrrry wrote: post #37
yjftsjthsd-h wrote: post #25

Earlier quoted context omitted.

It's not a security feature, it's a UX feature.

True, but if there's a communication bug between UX and back-end teams, that can escalate into a false sense of security and then an exploit.

That's one benefit of using ts on server. We share same zod validation on both end.

Re: HTML Form Validation is underused

#64

Post by jhardy54 »

unlog wrote: post #22

In an all honest reply, is that the people that writes these specifications, live disconnected from the reality, they don't use the stuff they specify. That stuff works for very simple things, but then when your forms evolve you realise you will be better off just writing the whole thing yourself.

Yep. This is great until you need a cross-browser date picker, at which point you need to implement a bunch of stuff yourself. It’s frustrating how primitive HTML forms are, after so many years.

Re: HTML Form Validation is underused

#65

Post by [deleted] »

montag wrote: post #42

It's also easily misused. Take the regular expression validator for passwords on the California DMV website, for example. The website states "Must include at least 4 alpha characters". But the validation pattern ^(?=(.*[a-zA-Z]){4,})(?=.*[0-9!#$%]).+$ requires that these characters appear consecutively .

[deleted]

Re: HTML Form Validation is underused

#67

Post by kadoban »

Jerrrrrrry wrote: post #37
yjftsjthsd-h wrote: post #25

Earlier quoted context omitted.

It's not a security feature, it's a UX feature.

True, but if there's a communication bug between UX and back-end teams, that can escalate into a false sense of security and then an exploit.

What the hell back-end team relies on their front-end teams to tell them to do input checking?

Nothing my front-end people could possibly do would trick me into trusting user input.

Re: HTML Form Validation is underused

#68

Post by eddd-ddde »

montag wrote: post #42

It's also easily misused. Take the regular expression validator for passwords on the California DMV website, for example. The website states "Must include at least 4 alpha characters". But the validation pattern ^(?=(.*[a-zA-Z]){4,})(?=.*[0-9!#$%]).+$ requires that these characters appear consecutively .

The {4} is being applied to the whole group which includes a .*

Isn't that correct?

Re: HTML Form Validation is underused

#69

Post by FrostKiwi »

jansommer wrote: post #66

Html form validation is great. There's just one gigantic catch: It doesn't work in Firefox for Android. https://bugzilla.mozilla.org/show_bug.cgi?id=1510450

As a daily Firefox on Android user, not catching up on standards is what hurts the most. Most painfully to me, all the WebGL stuff like [1] and some minor annoyances like [2]. Still, having uBlock origin among other extensions is a killer feature.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1884282

[2] https://bugzilla.mozilla.org/show_bug.cgi?id=1897707

Re: HTML Form Validation is underused

#70

Post by moron4hire »

jansommer wrote: post #66

Html form validation is great. There's just one gigantic catch: It doesn't work in Firefox for Android. https://bugzilla.mozilla.org/show_bug.cgi?id=1510450

Firefox for Android has a smaller user base than Samsung Internet and Opera. It's 0.5%. It's a waste of time working on supporting it. Especially considering how little time people put into making sure their sites work for people using accessibility software. I don't think it's worth mentioning in these issues unless you're also ready to talk about UC Browser.
Post reply on HN