client-side input validation