Client-side vs. server-side validation