So I'm working on an application where Javascript will first validate the email using a regex and then once sent to PHP, PHP will verify the user did not modify any of the javascript and validate the info again with filter_var. For example, in JS I validate with this regex first using .test()/^(([^<>()\[\]\\.,;:\s@]+(\.[^<>()\[\]\\.,;:\s@]+)*)|(.+))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/This is a regex I picked up off emailregex.com and seems to validate everything fairly well. After the form is submitted I use php filter_var($email, FILTER_VALIDATE_EMAIL) to once again validate. Does this method have any downsides and would there be any better ways to do this?
Javascript to PHP email validation?
javascript;php;jquery;regex;validation
Client-side validation is for user convenience and, marginally, to reduce load on your server... the user will be notified more quickly of an error, speeding up the process of correcting it, and the user's computer handles the processing.Server-side validation is for security and safety, because you can't trust the client. Users can disable or disrupt JavaScript (sometimes by accident), or they can use tools like Postman to fake HTTP requests.Sounds like you are doing things correctly.One downside that comes to mind immediately is when your client-side and server-side validation don't match. For example, if your client-side validation is stricter (accidentally), you could end up with a scenario where things look secure but are actually vulnerable to HTTP request hacking. This can be mitigated with lots and lots of automated testing of both the client-side and server-side services.Another downside is code replication. Keeping both the client and server up-to-date and in sync with ever-changing requirements can be tedious and error prone, and sometimes server-side and client-side technologies aren't exactly one-for-one, making it difficult to engineer identical solutions. Once again, lots of automated testing can mitigate errors and ensure that both client and server are in sync.