Never trust the end user

It may seem like harsh advice, but given the nature of the Web environment, it's an absolute must.

You should always inspect, filter, escape, and validate every piece of input made by the end user. The criteria should not only pertain to the application business logic but also to the security and safety aspects of the data itself. Make sure to scan the input for possible malicious code and protect your application from possible code injection attacks. Wherever possible, work with secured applications that require registration and/or authentication. Be careful when delegating privileges and access control rights to the end users, and when applicable, implement an auditing mechanism.

Client-side validation

Client-side validations are great to enhance the end user UI experience. However, they can't replace the server-side validation in any way. Due to the open and accessible nature of JavaScript code in the Web browser, it can be very easily manipulated and made to lose...