tobyink offers the modern HTML(5) way. You also asked about validation. You RFC:MUST not trust user input, Validation is only secure on the server side. JS has no say whatsoever in what a hacker decides to send or an old or non-compliant browser submits. Check all user data. I personally tend to reach for Date::Calc’s check_date for raw validation. Up to you to decide what ranges are acceptable beyond the pure validity of the YYYY, MM, DD given to it.