Suppose I have a form, and one of this form inputs I set the max length to 15:

<input type="text" name="username" maxlength="15">

Now the attacker wants to override this limit, to do that he will simply fire "Inspect element", click on the input, change the value from 15 to 200.

My question here, is there a better way to set the max allowed characters for html forms?

  • 9
    Any security-related input verification should always be performed on the server side after the data is submitted, not on the client side. Server side checks would need to be coded in whatever language your website backend runs - PHP, ASP, etc. Checks in HTML/JS can easily be overridden and are meant to be used only to enhance user experience; they are not a security measure.
    – tlng05
    May 4, 2015 at 1:06
  • @user54791 Additionally with the right web development framework, the format can be specified just once to automatically validate on both client side and server with the same requirements.
    – kasperd
    May 4, 2015 at 11:48

2 Answers 2


The "better way" is server-side validation, because you simply cannot control what the client will send. It does not matter what client-side method you use - <input maxlength=, javascript, what-have-you.

To quote OWASP:

Note that client side validation is a fine idea for performance and usability, but it has no security benefit whatsoever. Server side checks are required to defend against parameter manipulation attacks.

See also this answer which lays the difference out nicely.


Nope. That's pretty much the best you can do on the client. The key is to have strong input validation on the server. Always treat all input as suspicious.

Input validation on the client is to improve the user experience. The security happens on the server.

PS: You could add JavaScript validation but it adds no real security because an attacker can bypass your web app completely and send malicious requests.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .