PHP Child / The Two Halves

Nothing that arrives from a visitor can be believed

The oldest rule in this half of the web, and the one that explains most of the rest.

Everything that reaches a site from outside is a claim, not a fact. A typed name is a claim. A chosen quantity is a claim. A selection from a list of options is a claim. So is the description of the device asking, the page it says it came from, and every other detail attached to the request. None of it was produced under the site's supervision. All of it can be anything at all, because it originated somewhere the site does not control and travelled through places it does not control either.

This is not suspicion of visitors. Most of what arrives is honest, and the rule is not really about dishonesty. It is about the difference between a value you produced and a value you were handed. A site that treats a handed value as a produced one has stopped reasoning and started hoping. The discipline is simply to check: is this the kind of thing I expected, is it within the range I allow, does this person have any business asking for it, and what will I do if the answer is no.

Beginners often assume a check placed on the visible half solves this. A choice restricted to three options, a box that refuses more than a certain length, a field marked required. Those are courtesies to honest visitors and they genuinely improve the experience. They are not protection, because they live on the side that can be altered. The same check must exist again on the controlled side, where it cannot be edited away. Duplicating it is not waste. The two checks have entirely different jobs.