you always use server side validation.

Always always always.

JavaScript validation is only a convenient way to the user to fix their problems before they have to submit. But ultimately, it doesn't count for anything legit.

Also, a lot of bots won't even pick up the javascript, so someone could just as easily spam your site with false information.