Should user input of a contact form be validated?

Question

On software company websites I visit the first time, I often open the "Contact us" page and try to submit the contact form with all fields empty. I am just curios if they validate the user input.

If it is just submitted or only validated poorly (e.g. only Javascript validation), I often hear myself thinking

Oh, look how sloppy they are! Can't even validate user input. That calls itself a software company? No, I don't think I want to buy any software services of them.

A friend of mine has such a "sloppy" contact form. You can submit a completely empty form. I asked him why he does not validate user input, and he said:

Look, I want that customers can contact me. They should enter any information they want. If they only want to enter a message and leave the other fields empty, why should I care? They enter the relevant information anyway. I do not want to add any barriers when contacting me.

I did not ask him how many empty messages he gets, though.

However, what is the better option now? Both arguments (check how company handles user input vs. not adding any barriers in contacting) seem to make sense for me.

I want that the user can easily contact me, but still has the impression that I am precise when programming webpages.

Answer 1

From UX point of view

and try to submit the contact form with all fields empty
[...]
If they only want to enter a message and leave the other fields empty, why should I care?

You and your friend are not talking about the same scenarios.

Letting the user submit all fields empty on a contact form is a mistake, because there are no valid cases where the customer would be contacting you while saying nothing. If he has nothing to say, why is he submitting a form?

The only possible scenario where the customer actually submits an empty contact form is that he pressed Enter by mistake when the focus was on a single-line text field (or he pressed by mistake the submit button).

Validation, at this level, at least client-side one, is a must-have and has a specific purpose. If a customer is submitting an empty contact form, he should be notified that something is wrong and the submission should be prevented.

Making all field mandatory on a contact form is not a solution neither. When I want to tell someone that there is a typo on the home page of their website, I don't want to think about the subject of the message, I don't want to give my email address, I don't want to give my phone number, and I don't want to specify the name of my girlfriend, because, damn it, all I want is to tell is that there is a typo.

From technical point of view

Processing submitted contact forms is a complicated task which requires lots of time. Filtering technically the submissions you don't need improves productivity of the person in charge of reading those messages.

There is no need to display the empty messages in the administration panel. I would even say that messages with a length inferior to, say, ten characters, are useless, and shouldn't be displayed neither.

On the other hand, doing validation response properly is a difficult task: you have to implement validation itself both server-side and optionally client-side, and respond properly with a (often) localized error message or a cleaner, more UX-oriented way.

For the sake of simplicity and given the specificity of the case, I wouldn't do any server-side validation response, only client-side. If the user with no JavaScript wants to submit an empty contact form, that's fine: administrators will never see those submissions, but the customer will be convinced that the form was submitted successfully. This case is too specific (i.e. the user doesn't have JavaScript, makes a mistake when submitting a form and this mistake doesn't affect the system) to handle specifically.

Answer 2

Validation is important for two reasons:

1. If you don't have any validation, you may end up with your database/inbox full of useless messages (Messages that have no content or messages whose sender info is missing or makes no sense).

2. SQL injection. Not having any validation may compromise your database.

However:

No. 1 may not be an issue if, like your friend, you don't mind getting some fields empty.

No. 2 may not be an issue if you don't save the data from the form to a database (I've seen contact forms that use the data to send an email to the company's support department without ever storing them in a database, for example.)

So the answer here is (as it is so many times): It is good practice, but depends on the particulars of the project.

Answer 3

Depends on the requirements. In general, you should strike a balance between no and too much validation. I would validate on fields that are required to be meaningful all the time, like phone numbers, email addresses and the like. Free text fields are of course free of validation. I would say not validating on empty forms is a waste of round-trip and storage (if it does get saved!). One thing you should consider for contact forms as with all input is validating/sanitizing against cross-site scripting.

Answer 4

You should validate your form before user submission .Because if you did'nt validate the fields properly user can submit empty forms without any data .