← notes

A form that posts without leaving the page, and the gate that actually enforces

Apr 26, 2020

The Congo Developers Club site before the Jekyll rebuild, with a jQuery signup form and a launch countdown.

js/subscribe-form.js and jquery.form.min.js post to include/subscribe-process.php without a page reload. jQuery.form did one useful thing: it serialized a form and submitted it across browsers that disagreed about how. That is now new FormData(form) and fetch in about four lines, natively. The plugin was 2010s infrastructure the platform absorbed.

What has not changed is the validation split, and people still get it wrong. Client-side checks are for the person filling in the form, instant feedback, no round trip. They are not a gate. subscribe-process.php is the only place anything is enforced, because it is the only place an attacker cannot skip. A form with thorough client validation and a trusting endpoint is unvalidated.

Progressive enhancement is what a JS-first form drops: without a plain form action as fallback, a visitor with a script blocker gets a button that does nothing, silently. The same failure as a blocked MailChimp embed, from the other direction.

The countdown is the other period detail, client clocks drift, so a launch timer shows a different number to everyone unless anchored to a server timestamp.