firstly thats a cool little script, very clear on what your clean and tainted data is etc
im a believer in defence in-depth, if your going to validate in JS you MUST still validate in php, validation in JS is a cool idea as you can make sure the data sent to your servers are maybe as you expected... but all you have todo is use httpliveheaders to figure out the names of the form vars placed by the js and then hard code a form or just send a modifyed http request via the httpliveheaders tool... effetivley bypassing your JS validation... not cool
|