server-side and client side validation