Forms and Validation

A form is where an application stops being in control. Everything that arrives through a POST is a string produced by someone else: a hurried user, a browser that autofills a field, a script that bypasses the page. The "publication year" field might contain 1985, nineteen hundred, nothing at all, or three hundred characters.

The question is therefore not whether the data will be invalid, but where the application decides to detect it. The natural reflex, checking at the top of the controller method, produces code that piles up if statements, mixes business rules with web plumbing, and duplicates the same checks everywhere the object is received. After a few screens, two forms that handle the same object no longer validate it the same way.

The other reflex, relying on browser validation with required and type="number", is comfortable and wrong. These attributes improve the user experience but protect nothing: they are evaluated on the client, which can disable them, and a well-formed curl request ignores them entirely. Client-side validation is a convenience; server-side validation is a guarantee.