Server-Side Form Validation — Why It's Non-Optional

// Example: validating a form submission server-side in Node.js
// (You don't need this with splitforms — but here's what splitforms
// does for you on every submission.)

import { z } from "zod";

const ContactSchema = z.object({
  name: z.string().min(2).max(120),
  email: z.string().email().max(255),
  message: z.string().min(10).max(5000),
  // Honeypot — should be empty
  botcheck: z.string().max(0).optional(),
});

export async function POST(request: Request) {
  const formData = await request.formData();
  const data = Object.fromEntries(formData.entries());

  const result = ContactSchema.safeParse(data);
  if (!result.success) {
    return Response.json(
      { success: false, message: "Invalid input", issues: result.error.issues },
      { status: 400 }
    );
  }

  // Send email, store submission, fire webhook, etc.
  // ...

  return Response.json({ success: true, message: "Submission received" });
}

Client-side validation runs in the user's browser. It's for UX — blocking obvious mistakes (empty required fields, malformed emails) before the form hits the network. It's also trivially bypassable: anyone with DevTools can disable it, delete the validation script, or POST directly with curl. Treat client-side validation as a hint, not a guarantee.

Server-side validation runs on your backend. It's for security and data integrity. Every field that reaches the server must be re-validated, regardless of what the client said. Required fields must be present; email format must be valid; lengths must be within bounds; types must match the schema. Without this, a malicious actor can submit arbitrary garbage to your database and APIs.

What to validate server-side: every field. Required fields are non-empty. String fields match the expected format (email pattern, URL pattern, phone pattern). Numeric fields fall within min/max ranges. File uploads match the expected size and MIME type (don't trust the `accept` attribute or the file extension). Multi-select fields contain only allowed values.

If you use splitforms, you don't write any of this. Every submission to `/api/submit` is validated server-side: format, length, file size, MIME type, rate limits, origin checks, AI spam classification. Malformed submissions get rejected with a clear JSON error; valid submissions proceed to email + storage + webhooks. The server-side validation is the service you're paying for (or getting free).

Client-side for UX. Server-side for security. You need both — or splitforms.