我的JavaScript验证足够了吗？ [英] Is my JavaScript validating enough?

问题描述

我有一个关于从使用AJAX提交的表单验证数据的问题（并不重要）。

我使用jQuery验证它，通常有三件事：

• 
  
• 数据的长度（以及数据的种类）是否正确？


• 数据是否与正则表达式匹配没有奇怪的XSS字符等）

我的问题：我需要多少验证来重复serverside？用户是否可以执行JS和/或更改我的HTML，以便将任何危险代码提交到后端？在JavaScript和客户端验证上依赖。仅仅因为用户可以很容易地禁用或规避您的客户端验证。

任何用户输入都应该视为无效，直到在服务器端进行验证为止 。

客户端验证应该被认为是很好有功能，以增加应用程序的UX值（它允许用户更快地检测错误，而不是必须重新填写表格）。但就是这样。它不是固体服务器端验证的替代方案。

I have a question concerning validating data from a form submitted using AJAX (doesn't really matter).

I am validating it using jQuery, usually three things:

• Is there any data in the field?
• Is the length of the data (and the kind of data) correct?
• Does the data match the regex (no strange XSS characters etc.)

My question: How much of the validation do I need to repeat serverside? Can users execute JS and/or change my HTML in a way that any hazardous code will be submitted into my backend?

解决方案

Never rely on JavaScript and client-side validation. Simply because a user can very easily disable or circumvent your client-side validations.

Any user input should treated invalid until validated on the server side.

Client-side validations should be considered as a "nice to have" feature, to increase the UX value of your application (it allows users to detect errors sooner, not having to refill the form). But that's all it is. It's not an alternative to solid server-side validation.

这篇关于我的JavaScript验证足够了吗？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！