Form validation defined.
Form validation is the checking of submitted input against rules like required fields, correct format and allowed length, either in the browser before sending or on the server after it arrives.
How form validation works client-side and server-side
Validation happens in two places, and they do different jobs. Client-side validation runs in the browser before anything is sent, using HTML attributes like required, type="email" and pattern, or a little JavaScript. It gives instant feedback and catches honest mistakes, but it is only a convenience, because anyone can open the developer tools, strip the attributes, and POST whatever they like.
Server-side validation runs after the data arrives and is the checking that actually protects you: it re-applies every rule on data it fully controls, rejecting or flagging anything malformed. The reliable pattern is to do both, treating the browser checks as UX and the server checks as the real gate.
A form backend is where that server-side gate lives when your site is static, so FormWire validates required fields and formats on arrival, catches empty or malformed submissions, and pairs the check with spam filtering before anything reaches your inbox.
The rules a form applies.
Presence and format
Required fields are filled, emails look like emails, numbers are numbers. The cheap checks that stop most broken submissions at the door.
Length and range
Bounds on how long a value can be and what values are allowed, so a runaway paste or an out-of-range number is rejected before storage.
The server as the gate
Browser checks are advisory; the server re-runs them on data it controls. This is the check an attacker cannot skip past.
Related questions
Because browser validation is trivial to bypass. The rules live in HTML and JavaScript the visitor controls, so a bot or a curious user can disable them and POST straight to your endpoint. Server-side validation runs on data the server owns, which is why it is the only check that can actually protect what you store.
It stops malformed and empty submissions, but not a bot that fills every field correctly. Spam needs its own layer (a honeypot, a captcha, rate limits) that sits alongside validation rather than replacing it. A hidden honeypot field is itself a kind of validation rule, and if it is filled the submission is a bot.
See how FormWire filters spam →Return a clear error status so the sender knows it did not go through, commonly a 422 for a well-formed request that fails the rules. The response tells an honest client to fix and resend, while junk simply never reaches your inbox.
Yes. FormWire applies sensible defaults and lets you require specific fields per form, so you keep the granular UX validation in your own HTML and lean on the backend for the server-side gate. See the docs for the fields you can require.
Want to see it working?
Read the docsCatch bad input before it reaches you.
Free tier forever. No credit card required.