title: Some users bypassing client side validation
body: <p>I'm trying to get to the bottom of how some of my websites users are bypassing client-side javascript form validation.  I have a multi-step form that will not work with javascript switched off as it's steps are shown / hidden as you progress, and the submit button works via ajax (ie it doesn't have the <code>type="submit"</code> attribute).</p>
  
  <p>I'm using the <a href="http://1000hz.github.io/bootstrap-validator/" rel="nofollow">1000hz validator.js</a> library to handle validation and from extensive testing I'm confident it works across all inputs on the form.</p>
  
  <p>One of the fields on the form is a UK mobile phone number, so it should start 07 and be 11 numbers long.  I'm using a regular expression <code>pattern="^07\d{9}$"</code> for this check and it works just fine, in that I can't progress with the form unless the format is entered correctly.</p>
  
  <p>From looking through the form submissions though I'm finding around 1% of applications with this field entered in an invalid format, for example 12 characters long or else with special characters, eg country code prepended <code>(+44)</code></p>
  
  <p>I don't think there's anything malicious going on, for example people attempting to post this data using a tool as it does look like valid traffic.  </p>
  
  <p>The user agents for these posts are all slightly different however a lot of them seem to come from Android 4.4.2, ie..</p>
  
  <pre><code>Mozilla/5.0 (Linux; Android 4.4.2; N830 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Mobile Safari/537.36
  </code></pre>
  
  <p>I've tried to replicate this using a similar device but the validation appears to be working just fine.</p>