Well, part of the problem is you are using Client side validation.
It is very simple to get around client side validation. Client side validation uses javascript and is performed in the clients browser. To get around client side validation, you simply turn of javascript in the browser settings.
you should use server validation instead.