add validation on the server and client side