You cannot allow the server to trust that the client side is not tricking it, especially for ecommerce.

All form validation must happen at the server, and possibly, for a better user experience (think responsiveness), also validated with javascript.

I'd also like to note that inn my experience most the javascript validation I met really sucks. Just recently I had to fool an online purchase form which was trying to verify my CCN using javascript that calls a VB script function. I have MacOS X, and use Safari, which isn't VB script enabled.

The only way I could actually buy the thing is if i cheated the javascript. It was simple, too, i just entered the URL javascript:document.formname.submit().