Client-side validation should never replace server-side validation. JavaScript, for example, is easily disabled and you should not assume that your scripts will always receive data from the forms you have designed.