Where validation has to happen

• A

  No, provided the form validation cannot be bypassed by the user interface

• B

  Only for fields that are stored, since transient values cannot cause harm

• C

  Yes, because requests can be sent without using the form at all

• D

  Only if the form is publicly accessible rather than behind a login