Code can run in two places. Client-side code runs on the visitor’s device, inside the browser. Server-side code runs on the computer that hosts the website.
| Client-side | Server-side | |
|---|---|---|
| Examples | HTML, CSS, JavaScript | PHP, Python, Node.js |
| Runs on | The visitor’s browser | The web server |
| Can the visitor read the code? | Yes, always | No, only the output |
| Can it reach the database? | Not directly | Yes |
| Speed of reaction | Instant, no network | Needs a request |
The trust rule
Everything that runs in the browser can be changed by the visitor. A person can open the developer tools, edit the page, turn off JavaScript or send a request by hand without using your form at all.
That leads to a rule you will use throughout this course:
Never trust data that comes from the browser. Always check it again in PHP.
index.php
PHP
<?php
// The browser sent this price. A visitor could have changed it.
$priceFromBrowser = "1";
// The real price comes from your own data.
$realPrice = 49.99;
echo "Charging: " . $realPrice;
Output
OUTPUT
Charging: 49.99The shop charges the price it knows, not the one the browser sent.
Which side for which job
- Server-side: passwords, payments, permissions, saving data, anything secret.
- Client-side: quick feedback, animations, menus, anything that should react without a page reload.
lightbulb
Use both for forms
Check a form in JavaScript so the user gets a fast message, then check it again in PHP so bad data can never get in. Form Validation shows the PHP side.