Comment by mannyv

The real problem with client-side validation is you can't trust it.

You need to revalidate on the server, no matter what.