function checkNumber(number) {
        event = document.all ? window.event : number;
        key = document.all ? event.keyCode : event.which;
        if(key<48||key>57) {
            if(document.all) { event.returnValue = false; } else { event.preventDefault(); }

This is my function for preventing users to enter anything but numbers. But still not sure if it is secure since users may interact with it via a textbox. Thank you. Textbox code:

<input name="TCashpoint" type="text" required="required" class="LBInput" placeholder="Enter only an integer." onkeypress="checkNumber(number)" maxlength="9">

PS: This is the client side code.

  • Is this serverside or just client side? If it is client side please be aware that the end user can alter the input before sending it to the server. – meowcat Apr 14 at 22:48
  • Oh forgot that js serverside is a thing... This is clientside and function is called whenever text box changes. – Flame Apr 14 at 22:58
  • consider copy-paste into the textbox. – Z.T. Apr 15 at 0:15
  • Data sent to server should be validated there. Client side validation is for UI/UX purpose only. Also why not use regex for validation ? – Rahul Apr 15 at 2:33
  • Well, to be honest, I didn't know how to use regex when I wrote this script and am too lazy to change since it still checks on the server side. I was just curious about can this kind of code cause a vulnerability. – Flame Apr 15 at 4:32

All client side code insecure by design. Unfortunately no matter how well you code your function, it can be easily bypassed by the end user. If this data is going to be passed to a server please validate it at the server end as well.

Client side validation is purely for 'usability' and not security (i.e. let the client know that they have added an incorrect answer, genuine users will change their answer to conform, malicious users will edit the code or use a proxy to send off malicious text). For security you must check it on the server side.

  • I already check it on the server but I thought also checking here might be useful. But is it secure to let this code stay in my client? Or is it a bad idea? What harm can malicious person do? – Flame Apr 14 at 23:09
  • It should be fine, a malicious person should not be able to harm your server with this function. Although I think you will find key<48||key>57 should be key<=48||key>=57 – meowcat Apr 14 at 23:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.