function validRequired(formField,fieldLabel,alertmsg)
{
var result = true;
if (formField.value == "")
{
if (alertmsg == "") {
alert('Please enter your ' + fieldLabel +'.');
} else {
alert(alertmsg);
}
formField.focus();
result = false;
}
return result;
}

And then it’s called like this:
for using the “default” alert message:

if (!validRequired(formname.name,"name","")) {
return false;
}

or this way to put in a “custom” alert message:

if (!validRequired(formname.iLikePie,"","Please type in yes or no or whatever you want.")) {
return false;
}

<script language = "Javascript">
/**
* DHTML email validation script. Courtesy of SmartWebby.com (http://www.smartwebby.com/dhtml/)
*/
function echeck(str) {
var at="@"
var dot="."
var lat=str.indexOf(at)
var lstr=str.length
var ldot=str.indexOf(dot)
if (str.indexOf(at)==-1){
alert("Invalid E-mail ID")
return false
}
if (str.indexOf(at)==-1 || str.indexOf(at)==0 || str.indexOf(at)==lstr){
alert("Invalid E-mail ID")
return false
}
if (str.indexOf(dot)==-1 || str.indexOf(dot)==0 || str.indexOf(dot)==lstr){
alert("Invalid E-mail ID")
return false
}
if (str.indexOf(at,(lat+1))!=-1){
alert("Invalid E-mail ID")
return false
}
if (str.substring(lat-1,lat)==dot || str.substring(lat+1,lat+2)==dot){
alert("Invalid E-mail ID")
return false
}
if (str.indexOf(dot,(lat+2))==-1){
alert("Invalid E-mail ID")
return false
}
if (str.indexOf(" ")!=-1){
alert("Invalid E-mail ID")
return false
}
return true
}
</script>

So they’re display of the validation function looks like this:

function ValidateForm(){
var emailID=document.frmSample.txtEmail
if ((emailID.value==null)||(emailID.value==”")){
alert(”Please Enter your Email ID”)
emailID.focus()
return false
}
if (echeck(emailID.value)==false){
emailID.value=”"
emailID.focus()
return false
}
return true
}

function validRequired(formField,fieldLabel) {
var result = true;
if (formField.value == “”) {
alert(’Please enter your ‘ + fieldLabel +’.');
formField.focus();
result = false;
}
return result;
}

Then in the main validate function do this for each field you’re checking:

if (!validRequired(formname.first_name,”first name”)) {
return false;
}

For example:
How will you be arriving?
(_) car
(_) boat
(_) airplane
(_) flight 001
(_) flight 002

If you select “airplne” then you have to select which flight…

Here’s the code that will validate the form is filled out correctly:

var airplaneChecked = false;
var flightChecked = false;
for (i=0; i<document.formName.transport.length; i++) {
if (document.formName.transport[i].checked && document.formName.transport[i].value == “airplane”) {
airplaneChecked = true;
}
}
if (airplaneChecked) {
for (i=0; i<document.formName.flight.length; i++) {
if (document.formName.flight[i].checked) {
flightChecked = true;
}
}
}
if (!flightChecked && airplaneChecked) {
window.alert(”Please select a flight.”);
document.formName.flight[0].focus()
return false;
}

Javascript is the quick solution but always back the filters up with something that can’t be disabled.

…but “+”? Is that even an allowed character for email? I didn’t think it was…

And make sure you don’t validate incorrectly…

Your email:
if (!(/^\w+([\.-]?\w+)*@\w+([\.-]?\w+)*(\.\w{2,3})+$/.test

Which appears to disallow + in the part before the @ and only allows @a.b.cc or @a.b.ccc and not @a.info or @a.b.c.d.e.f.g.h.museum or …

Over validating scares people away who might otherwise have spent some money or whatever…

Lazy form filler tries to fill out just one field where all fields are required - javascript catches each one and tells him “Sorry, dude - gotta fill out that field” “yup, AND that field” “YES! And that field too!!” - If you ONLY have server-side checking - then that’s three trips to the server. Three trips to the server when it was possible to catch it with javascript - that is what I mean by a “waste of server resources”.

My point in the beginning was check it with javascript then once again when the stuff gets to the server. (Not mentioned: in case (1) malicious stuff you talk about and/or (2) javascript turned off). “double”-checking the form data once on the server - that is NOT a waste of server resources.

Is that clearer?

And, at least from what I see from novice/intermediate web authors, they would interpret the combination of these two statements as “it’s mostly ok to ignore server-side checking”. I’ve seen this happen a number of times in newsgroup I frequent, and it’s hard to explain to people why.

But I felt that it had to be clearified. I apologize for any scratchmark you unintentionally got from my claws.