Should you do validation on the server side?

Well, fine, all YOUR code is correct. What happens when a hacker replaces your javascript with one of their liking, or just plain submit POSTs and GETs as if it were your code?

Validating at the client is a usability issue.

Validating at the point of USAGE is a security issue.

That last point is important, because if you do not validate at the point of usage, you are making your code highly coupled. If you change a module, it breaks things elsewhere because you validated at the wrong point.

For instance, you validate data against SQL injection before storing in a SQL database -- the library will do that for you if you choose a good one. You validate data against CSS when you display it as HTML. But if you expose the data it as XML, RSS or JSON, then the validation is different -- if you validated it just at input, you wouldn't prevent exploits for the other formats, AND your input routine would be tied to the output formats you choose.

In addition to the issue of a user with Javascript turned off, server-side validation is necessary for security. In addition to checking things like required fields, you also want to check the user-supplied data to prevent SQL injection attacks, cross-site scripting, etc. You have to do this on the server side, because a user can always bypass the Javascript and send you any data they want.

Client side validation is against the concept of "world wide web" because the reason for which we made html text based is because each device must be able to process rsponce however small the device is. Now client side validation demands processing power of the device used which is not what "www" expects from a device consuming html. Client side validations are particularly important for saving bandwidth , as internet speeds are increasing day by day there will be a time when we no longer require client side validations.