in a web application javascript should never be your only validation. it can be disabled in any browser.