You should always have a server side validator, just in case some of your
users don't support JavaScript (or they turned it off). And remember,
postbacks do not have to come from your page, it's so simple to fake a form
submission with made up values. The moral is never trust anything that comes
from the client, no matter how much validating JavaScript you have there.
Jerry