&quot;Javascript should be used for form validation.&quot;<p>Just to be clear and ensure everyone else understands.  Javascript should validate input syntax and make decisions that don&#x27;t need to be forced onto users.  As an example, validate a credit-card matches mod 10 and automatically recognize if it&#x27;s Visa, Mastercard, etc.  Nothing drives me nuts like messing up my card-number only to have to go through an entire HTTP request &amp; response cycle to find out.<p>What we don&#x27;t want developers to do is ONLY validate client-side lest they open their back-end to injection vulnerabilities like XSS, SQLi, and CMDi or even name your own price vulnerabilities like we saw early on in the ecommerce space.