Validating data should always be done on the server. You should never, ever, trust the client.

That's not to say you can't do (or shouldn't do) form rendering, processing, error/success handling, etc. on the client-side, but the server should always have the last word on the validity of what you send.