Why can’t we just use JavaScript or HTML 5 attributes that restrict input data to ensure that forms are properly filled out? Why must we also validate on the server-side?

Client-side validation provides the user with quick feedback without expecting for the page to load. But, if the client has turn-off or disabled the client-side scripts (JavaScript), the validation will not execute which is why there is a need of the server to verify the values as well.

In other words, if the users turn-off the JavaScript, then it can simply bypass and submit the dangerous data to the server. Hence, Client-Side Validation can't guard the application against malicious attacks on the server resources and databases. That's why it is recommended that the Server-side validation is more SECURE!