front-end vs back-end form validation

[lectrospin]

Why is it that people tend to favour back-end form validation when using flash? Is there a particular advantage to this method that i'm missing? It seems to me that if you validate in flash before sending to a server, it's probably gonna cut down on unecessary server traffic and be faster.

[CyanBlue]

Not all the time... Let's say you have a simple login system in HTML page where it calls PHP script after the submit action... You do the frontend validation to make sure all the fields are filled out and maybe you can add in email validation if there is one... But in the backend, you'd do the same and add in additional processes such as check to see if data has any sort of database injection or not, or check the referrer which can be hard in the frontend...
Also, you can sniff out the traffic and try to bypass the frontend to do something other than it is supposed to do... If you don't validate from the backend in that case, you lose big time...

It's safe to say that you'd need to validate in frontend and in backend at the same time... That's my 2 cents... ;)

[yell0wdart]

I tend to agree w/ that. When I validate stuff on the client, it's usually just making sure that fields or filled out, or maybe using a regular expression to validate email or phone number format, etc.

On the back end, though, I'll make sure to check for any XSS or SQL injection and encode the inputs accordingly.