Forms collect user input. Combine HTML5 attributes (required, type="email") with JavaScript validation before submit.
Layers
- HTML constraints — fast feedback, not security alone
- JS validation — custom rules, async checks
- Server validation — mandatory (client is untrusted)
Accessibility
Associate <label for> with inputs—errors need text, not color alone.
Important interview questions and answers
- Q: Client validation enough?
A: Never—attackers bypass browser; server must validate. - Q: reportValidity?
A: Triggers native UI for constraint validation API.
Self-check
- Why server-side validation required?
- Name one HTML5 validation attribute.
Tip: Re-run the playground code for forms-validation-preview and tweak one line before the MCQs.
Interview prep
- Client enough?
No—server must validate all input.