This is a basic example. Remember, determined exploiters can often bypass client-side checks, so it should never replace server validation .