Well ... discounting PerlScript on the client ... you have to validate on the server side. That's pretty much the standard since not too many of us have the luxury of being able to enforce client standards (but my how we try!).