什么时候应该进行数据验证？
例如，如果我想检查输入是否仅包含字母数字字符并且长度是否超过 10 个字符。我应该只在服务器端检查它吗？或者服务器端和数据库（查询）本身？或者只是兴致勃勃地检查客户端、服务器端和数据库端？
只是想找到检查的正确平衡点。
For instance, if I want to check is the input has only alphanumeric characters and is more than 10 characters long. Should I just check it server-side? Or server-side and in the database (query) itself? Or just go for the gusto and check it client-side, server-side, and db-side?
Just trying to find the right balance of checking.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
在客户端和服务器上进行验证是
一个好主意，但这是不恰当的。在客户端验证，但在后端处理数据时不要盲目相信结果。这可能会使您的应用程序容易受到恶意攻击，尤其是在驱动关键业务流程的表单中。首先在客户端验证数据，然后在后端验证客户端已视为有效的内容，从而保护自己，从而提高用户体验。
It's
a good ideaimpertinent that you validate on both the client and server. Validate on the client, but don't blindly trust the results when processing the data on the back end. This can leave your application open to malacious attacks, especially in forms that drive critical business processes.Increase the user's experience by first validating their data client side, and then protect yourself by validating, on the back end, what has already been deemed as valid by the client.
永远不需要在服务器端和数据库中执行此操作。是否在客户端检查它取决于您的环境以及应用程序的功能。在 Web 应用程序中，如果您运行大量客户端脚本来执行各种其他操作，那么客户端验证（如果没有必要）是理想的选择。重要的是，您需要在服务器端执行所有验证，即使您在客户端执行其中一些验证，因为如果您愿意，绕过客户端验证相当容易。
即使您没有做很多客户端古怪的事情，客户端验证也是非常有益的，因为它减少了对服务器的请求，这可以极大地提高性能（感知的和实际的）。
在数据库中进行验证是错误的地方，因为验证通常由业务规则驱动，并且数据层不应该是业务规则的所有者。
There should never be a need to do it both server-side and in the database. Whether or not you check it on the client-side depends on your environment and how the application functions. In a web application, if you have lots of client-side script running to do various other things, then client-side validation is ideal, if not necessary. The important part is that you need to do all validation server-side, even if you do some of it client-side, because it is fairly easy to get around client-side validation if you want to.
Even if you aren't doing lots of client-side wackiness, client-side validation is very beneficial because it reduces requests to the server, which can greatly help performance (both perceived and actual).
Doing validation in the database is the wrong place to do it because validation is typically driven by business rules, and your data layer should not be the owner of business rules.
始终验证服务器端。如果你想做动态 jQuery-ish 表单处理错误弹出窗口等，那么另外做客户端会很有帮助。不确定“在查询中”是什么意思——您的意思是在模式中吗？
Always validate server side. Doing client side in addition can be helpful if you want to do dynamic jQuery-ish form processing error popups and such. Not sure what you mean by "in the query" -- do you mean in the schema?
老实说，这是偏好，但也有好处。如果您处于高流量环境中，您可能不想在服务器端执行所有验证，因为进入服务器的流量越少越好。
因此，一部分是客户端，一部分是服务器端。
易于验证客户端的项目可能是：
取决于您的数据层是什么样的... 如果您使用程序，则应该有基本数据内置类型验证。
Honestly it's preference, but there are benefits. If you are in a high traffic environment, you might not want to do all of your validation server side because the less traffic you can have coming in to your server the better.
So do part of it client side and part of it server side.
Items that are easy to validate client side could be:
Depending on what your data layer is like... If your using procedures, there should be basic data type validation built in.