Client-side validation exists for the user, instant feedback, fewer round trips. It does nothing for the system, because anyone can bypass it with a crafted request.
The server validates everything, always: types, ranges, lengths, formats. The client-side check is a courtesy; the server-side check is the control. Systems that confuse the two end up with garbage in the database.
The rule is simple: never trust input. The browser is the user's territory, the server is yours. Validate where you control the ground.
