QAble

Browse by type

Explore all services
Functional
Functional Testing
End-to-end feature validation
Software Testing
Full-stack QA across disciplines
Software QA
Process, standards & audit QA
Independent Testing
Vendor-neutral V&V & sign-off
Cyber Security Testing
Pen testing & exploit validation
Enterprise Testing
ERP, CRM & core platform QA
Manual Testing
Human-driven QA testing
Exploratory Testing
Discover hidden edge cases
User Acceptance Testing
Business-aligned validation
Usability Testing
Real user experience testing
UI/UX Testing
Interface & interaction QA
Accessibility Testing
WCAG compliance testing
Accessibility Audit
Compliance gap assessment
Accessibility Remediation
Fix accessibility violations
Digital Accessibility
End-to-end inclusive design QA
Security & VAPT
Vulnerability assessment
VAPT Testing
Penetration testing & compliance
Performance Testing
Load & stress testing
Non-Functional Testing
Performance, security & reliability
Compatibility Testing
Cross-device & browser QA
Scalability Testing
Capacity & growth QA
Agile Testing
Sprint-aligned QA
Localization Testing
Language & regional QA
Digital Testing
Digital experience QA

What's New

Solution

Tesbo-X, Playwright Automation Framework

Intelligent test selection, parallel CI execution, and rich trace reporting unified in a single automation system.

Try for Free →
View all services
About UsWhy QAbleCertificationsCareers
Knowledge HubBlogQAble WeeklyCase StudiesEbooksUtilities
BetterBugs
BetterBugs
Tesbo-X
Tesbo-X
Talk to QA Advisor
Browse the Knowledge Hub74 resources
/Test Cases/Form validation test cases

Test cases

Form validation test cases, applied to any form

Twenty seven cases written as rules rather than one product flow: required and whitespace handling, length and numeric boundaries, paste behaviour, client and server parity, disabled and hidden field tampering, cross field and conditional rules, error announcement and mobile keyboards.

27cases/7coverage types/4security cases/FreeCSV download

All 27 test cases, ready to copy

Free to use and adapt, no sign-up. Download as CSV or Markdown, or copy it straight into your own tooling.

Last updated

27 worked examples

VAL-01

Submit a valid form

TypeFunctionalPriorityHigh
Test data
Every field completed within its rules
Expected result
Accepted, stored exactly as entered after documented trimming, and a clear success state shown.
VAL-02

Submit with every required field empty

TypeNegativePriorityHigh
Test data
All fields blank
Expected result
Blocked, an error against each required field, focus moved to the first one, and an error summary where the form is long.
VAL-03

Submit a required field containing only whitespace

TypeBoundaryPriorityHigh
Test data
Three spaces, then a tab, then a non breaking space
Expected result
Treated as empty and refused. A non breaking space pasted from a document is a real and confusing case.
VAL-04

Verify when validation fires

TypeFunctionalPriorityMedium
Test data
Type a partial email, then leave the field, then correct it
Expected result
Errors appear on blur or on submit rather than on every keystroke, and clear as soon as the value becomes valid. Validating mid typing tells users they are wrong before they have finished.
VAL-05

Verify values are preserved after a failed submission

TypeStatePriorityHigh
Test data
A long form with one invalid field
Expected result
Every other value is retained, including selections and uploads. Clearing a form on failure is the fastest way to lose a completed submission.
VAL-06

Check minimum and maximum length boundaries

TypeBoundaryPriorityHigh
Test data
Minimum minus one, minimum, maximum, maximum plus one
Expected result
Inside the range accepted, outside refused with the limit stated. Maximum length is enforced on paste as well as on typing.
VAL-07

Paste a value longer than the field allows

TypeBoundaryPriorityHigh
Test data
Paste 5000 characters into a 255 character field
Expected result
Refused or truncated with a visible message, never silently cut so the user submits something different from what they pasted.
VAL-08

Enter invalid characters in a numeric field

TypeNegativePriorityHigh
Test data
Letters, spaces, 1e5, --5, 1,000, 1.2.3, and a leading plus
Expected result
Refused with a clear message, or normalised by a documented rule. Exponent notation reaching a currency field is a genuine defect.
VAL-09

Check numeric boundaries and signs

TypeBoundaryPriorityHigh
Test data
Zero, negative, the maximum allowed, one above it, and a value beyond the integer limit
Expected result
Enforced server side. Quantity and amount fields must refuse negatives explicitly rather than relying on the input control.
VAL-10

Check decimal precision on money fields

TypeBoundaryPriorityHigh
Test data
10.005, 10.999, a value with four decimal places, and a locale using a comma separator
Expected result
Rounded or refused by a documented rule, and the stored value matches what is displayed to the currency minor unit.
VAL-11

Validate email formats

TypeBoundaryPriorityHigh
Test data
[email protected], an address at the length limit, user@, user@domain, and two at signs
Expected result
Valid unusual formats accepted, malformed refused. Over strict patterns that reject plus addressing are a defect, not a safeguard.
VAL-12

Validate phone and postcode by country

TypeBoundaryPriorityMedium
Test data
International prefix, spaces and brackets, a country with no postcode system
Expected result
Normalised consistently, and a country without postcodes is not blocked by a required field.
VAL-13

Enter names with punctuation and non Latin characters

TypeBoundaryPriorityHigh
Test data
O'Brien, Anne-Marie, a single character name, non Latin scripts, and an emoji
Expected result
Accepted and stored without corruption. Rejecting apostrophes or non Latin characters excludes real people and is a real defect.
VAL-14

Attempt script and SQL payloads in text fields

TypeSecurityPriorityHigh
Test data
<script>alert(1)</script>, ' OR 1=1 --, template expressions, and an HTML entity
Expected result
Stored safely and rendered as visible text everywhere it later appears, including admin views, exports and emails.
VAL-15

Bypass the browser and post invalid values directly

TypeSecurityPriorityHigh
Test data
A request violating every client rule at once
Expected result
The server refuses with the same rules and returns errors mapped to the correct fields. Client validation is convenience only.
VAL-16

Submit values for disabled and read only fields

TypeSecurityPriorityHigh
Test data
A request including a field that the interface disables, and one that is display only
Expected result
Ignored or rejected. Disabled in the markup is not a permission, and this is the classic mass assignment route.
VAL-17

Tamper with hidden fields

TypeSecurityPriorityHigh
Test data
Modify a hidden identifier, price, role or step token
Expected result
Validated against the session and the server record rather than trusted because it was on the page.
VAL-18

Verify cross field rules

TypeFunctionalPriorityHigh
Test data
End date before start date, confirm value not matching, total not equal to the sum of parts
Expected result
Refused with the error against the field the user can fix, and enforced on the server as well as in the browser.
VAL-19

Verify conditionally required fields

TypeFunctionalPriorityHigh
Test data
Toggle the condition on, fill the dependent field, toggle it off, then submit
Expected result
The dependent field is required only while the condition holds, and a value entered then hidden is either cleared or deliberately retained rather than being submitted invisibly.
VAL-20

Verify server errors map to fields

TypeFunctionalPriorityHigh
Test data
A rule only the server knows, for example an address that fails verification
Expected result
The message appears against the relevant field, not only as a banner, and the form remains completed and editable.
VAL-21

Submit the form twice quickly

TypeStatePriorityHigh
Test data
Double click submit, then resend the request
Expected result
One record created. The control disables while in flight and the endpoint is idempotent.
VAL-22

Navigate away from a partly completed form

TypeStatePriorityMedium
Test data
Change fields, then close the tab, press back, and follow an internal link
Expected result
An unsaved changes warning where the design promises one, and consistent behaviour across all three routes.
VAL-23

Verify autofill and password manager behaviour

TypeCompatibilityPriorityMedium
Test data
Browser autofill on address and card fields, plus a generated password
Expected result
Autofilled values pass validation, autocomplete attributes are correct, and paste is not blocked.
VAL-24

Verify the character counter and trimming rules

TypeFunctionalPriorityMedium
Test data
A field at its limit including trailing spaces and an emoji
Expected result
The counter matches what the server counts, including multi byte characters, and trimming happens consistently in both places.
VAL-25

Verify errors are announced to assistive technology

TypeAccessibilityPriorityHigh
Test data
NVDA or VoiceOver with a deliberately invalid submission
Expected result
Errors are programmatically associated with their fields, announced on submission, and the error summary is focusable and links to each field.
VAL-26

Verify errors do not rely on colour alone

TypeAccessibilityPriorityHigh
Test data
View the invalid state in greyscale and at 200 per cent zoom
Expected result
Text and an icon accompany the colour, contrast meets the standard, and the message stays visible when the layout reflows.
VAL-27

Verify the form on a mobile keyboard

TypeCompatibilityPriorityMedium
Test data
Numeric, email and phone fields on iOS and Android
Expected result
The correct keyboard type appears, the focused field is not hidden behind the keyboard, and the next control is reachable from it.

What goes in each field

ID

Required

Stable identifier, prefixed by module.

Test case

Required

What is being verified, in one line.

Type

Functional, negative, boundary, security, state, performance, accessibility or compatibility. Use it to check coverage is spread rather than clustered on the happy path.

Priority

Risk based. Any rule enforced only in the browser is High, because the endpoint behind it is the real interface. Message wording and timing are Medium unless the field is legally or financially significant.

Test data

The specific values, including the invalid and boundary ones.

Expected result

Required

The precise observable outcome, including message text where the wording itself is the requirement.

How To Use This

Send the request without the form

Everything the browser prevents, the endpoint usually allows. That is the whole test in one sentence.

Post every rule violation at once

One request breaking all client rules. The server should refuse with errors mapped to fields, not accept and store it.

Include the disabled fields

Disabled and read only in markup is presentation. Sending those keys is the classic mass assignment route.

Paste, do not type

Length limits enforced on keystrokes are routinely bypassed by paste, and silent truncation submits something the user never saw.

Fail one field on a long form

If the other twenty values are lost, users abandon. This is the highest impact validation defect there is.

What Most Sets Miss

The validation gaps worth writing down

Parity between the browser and the server is the whole game. Client validation exists to help a person; server validation exists to protect the data. When a rule lives only in the browser, the endpoint accepts anything, and every downstream consumer inherits the mess. Post one request that violates every rule at once and assert both the refusal and that each error is attached to the field it belongs to.

Disabled and hidden fields are where authorisation quietly leaks into validation. A price, a role, an identifier or a workflow step token that the interface disables is still just a key in a request body. Send it modified and confirm the server recomputes or refuses rather than trusting it because it was rendered on the page.

Over strict rules are a real defect class rather than a safe default. Rejecting apostrophes and hyphens in names excludes people, rejecting plus addressing in email breaks a legitimate and widely used pattern, and blocking paste in password fields actively discourages strong credentials. Each of those is a bug worth raising.

The most expensive defect on any long form is losing what somebody typed. Fail one field and check that every other value, including selections and uploaded files, survives. Users who lose fifteen minutes of input do not report it, they leave.

Suggest an improvement

Forms carrying revenue or compliance?

QAble tests validation at both layers, in the interface and against the endpoint, including the tampering cases that never appear in a browser.

Functional testing services

More test case sets

View all

Test cases for a login page

Test cases25 cases across functional, negative, boundary, security, session and accessibility paths, including account enumeration and lockout.

Test cases for a registration form

Test cases28 cases covering validation, duplicate accounts, email verification, password rules and the enumeration leak most signup forms ship with.

Test cases for search functionality

Test cases28 cases across relevance, partial and fuzzy matching, filters, pagination, empty states, injection attempts and performance under load.

Test cases for a shopping cart

Test cases27 cases on quantity limits, price recalculation, stock changes, coupon stacking, guest to account merge and cart persistence.

Test cases for checkout and payment

Test cases30 cases including 3D Secure, declines, timeouts, duplicate charges, idempotency, refunds and partial captures.

Test cases for file upload

Test cases28 cases on size and type limits, spoofed content types, malicious filenames, progress, resume, virus scanning and storage limits.

Test cases for forgot password

Test cases26 cases on reset token expiry, single use enforcement, session invalidation and the enumeration and rate limit gaps that are routine here.

Test cases for OTP verification

Test cases26 cases on expiry, resend throttling, attempt limits, code reuse, delivery failure and the brute force window teams forget to close.

Test cases for user roles and permissions

Test cases26 cases on horizontal and vertical privilege checks, direct object access, role changes mid-session and permission inheritance.

Test cases for a date picker

Test cases26 cases on timezone shifts, ambiguous day and month order, impossible dates, min and max limits, leap years and keyboard operation.

Test cases for pagination

Test cases24 cases on ordering stability, records changing mid-session, page size caps, deep offset cost, permission-filtered totals and state restore.

Test cases for push notifications

Test cases26 cases on app states, deep link routing, token release on sign out, lock screen privacy, preferences, provider failures and platform differences.

Test cases for reports and data export

Test cases25 cases on permission filtering in the file, spreadsheet formula injection, encoding, typed numbers and dates, row limits and audit logging.

Test cases for a chatbot

Test cases28 cases on paraphrased intents, context, fallback loops, human handoff, policy grounding, prompt injection and data scoping.

Test cases for net banking transactions

Test cases28 cases on duplicate debits from a retried request, concurrent transfers against one balance, daily limits across channels, beneficiary cooling periods, second factor binding and reconciliation.

Test cases for wallet and UPI payments

Test cases28 cases on payments that time out with no response, idempotency on retry, racing balances, caps across devices, collect request fraud, mandates and refunds.

Test cases for insurance claim submission

Test cases28 cases on coverage at the date of loss, waiting periods, deductibles and sub limits, exclusions and riders, duplicate claims and settlement reconciliation.

Test cases for patient records in an EHR

Test cases28 cases on duplicate detection and merge, wrong patient entry, units of measure, allergy and interaction alerting, break glass access and audit of reads.

Test cases for CRM lead management

Test cases28 cases on duplicate leads under concurrency, routing and the unrouted fallback, round robin races, territory visibility, conversion and bulk import.

Test cases for an ERP purchase order

Test cases28 cases on approval thresholds, amendments that must reset approval, budget commitment races, over receipt tolerance, three-way match and duplicate invoices.

Test cases for OTT video playback

Test cases28 cases on bitrate recovery after a dip, DRM renewal mid stream, concurrent stream limits and leaked slots, resume conflicts, ad cue points and offline expiry.

Test cases for game level progression

Test cases28 cases on save corruption during a crash write, cloud save conflicts, offline queue replay, unlock gating, currency exploits and purchase restore.

Test cases for a REST API

Test cases28 cases on status code correctness, cross tenant resource access, mass assignment, idempotent retries, cursor pagination, rate limits and contract drift.

Test cases for SSO and social login

Test cases28 cases on linking an account on an unverified email, state and code replay, redirect allow lists, token signature and issuer, deprovisioning and session rotation.

Test cases for subscription and billing

Test cases28 cases on mid cycle proration, duplicate and out of order webhooks, renewal double charges, dunning and grace, trials, coupons, metered usage and tax.

Test cases for data tables, filters and sorting

Test cases28 cases on unstable sorts across pages, filters that must reset pagination, selection surviving a filter change, bulk action scope and export fidelity.

Test cases for session timeout and concurrent login

Test cases28 cases on tokens that survive sign out, refresh token reuse, idle against absolute lifetime, multi tab expiry, session limits and remote revocation.

Test cases for a multi step form wizard

Test cases28 cases on values lost to back navigation, refresh and session expiry, step skipping, server side revalidation, duplicate submission and conditional branches.

Test cases for email verification

Test cases28 cases on token reuse and expiry, invalidating earlier links, account enumeration, header injection, safe address change and mail scanner prefetching.

Test cases for dashboards and analytics widgets

Test cases28 cases on reconciling against source rows, widgets that disagree, timezone aggregation, zero baselines, no data shown as zero and permission leaks in aggregates.

Test cases for booking and reservation

Test cases28 cases on concurrent bookings for the last slot, inventory holds that leak, payment without a booking, cancellation boundaries and channel sync.

Test cases for mobile app install and update

Test cases28 cases on migration chains across skipped versions, crashes during post upgrade migration, forced update lockouts, deep links and clean reinstall.

Test cases for accessibility (WCAG 2.2 AA)

Test cases28 cases on keyboard only completion, focus management, live region announcements, contrast, reflow at 320 pixels, target size and screen reader verification.

Test cases for performance and load

Test cases28 cases on spikes with no ramp, recovery after peak, soak and leak detection, pool exhaustion, cold caches, retry storms and data correctness under load.

Test cases for the OWASP Top 10

Test cases28 cases on broken access control, mass assignment, injection across every input surface, credential stuffing, session invalidation, SSRF and exposed secrets.

Test cases for cross browser compatibility

Test cases28 cases on storage that throws in private mode, blocked third party cookies, engine date parsing, mobile viewport units, in app browsers and ad blockers.

Test cases for database and data integrity

Test cases28 cases on uniqueness under concurrency, lost updates, counter races, orphaned rows, migration and backfill safety, replica lag and verified restores.

Test cases for localisation and multi language support

Test cases28 cases on text expansion, concatenated sentences, plural rules, locale date parsing, decimal separators, right to left layout, collation and encoding.

Test cases for outbound webhooks

Test cases28 cases on retry backoff and dead letter stores, one dead consumer degrading the pipeline, payload signing and replay windows, out of order delivery and endpoint SSRF.

Test cases for background jobs and queues

Test cases28 cases on work outliving the visibility timeout, idempotent handlers, poison messages, priority starvation, scheduler overlap across instances and graceful drain.

Test cases for real time features and websockets

Test cases28 cases on messages lost in the reconnect gap, half open connections, per channel authorisation, tokens expiring mid connection, backpressure and fanout across instances.

Test cases for file storage and media processing

Test cases28 cases on signed URL scope and expiry, serving before scanning completes, content type sniffing, metadata stripping, orphaned objects and derivative failures.

Test cases for CSV import and bulk operations

Test cases28 cases on reruns duplicating successes, delimiters inside quoted fields, byte order marks, leading zeros, ambiguous dates and bulk action scope.

Test cases for feature flags and progressive rollout

Test cases28 cases on unreachable flag services, unstable bucketing, rollouts that reshuffle users, kill switch latency, server and client mismatch and stale flags.

Test cases for Android app lifecycle and permissions

Test cases28 cases on state lost to process death, configuration changes, permanent permission denial, revocation while backgrounded, doze and battery restrictions.

Test cases for iOS app lifecycle and permissions

Test cases28 cases on the keychain surviving uninstall, suspended termination, limited photo access, allow once location, app switcher snapshots and biometric invalidation.

Test cases for wearable app sync

Test cases28 cases on data recorded away from the phone, duplicate records on resync, full buffers, clock drift, health permissions, battery budgets and unworn readings.

Test cases for VR and AR experiences

Test cases28 cases on the frame rate comfort floor, tracking loss, guardian boundaries, involuntary camera movement, AR anchor drift and spatial data privacy.

Test cases for IoT device pairing and telemetry

Test cases28 cases on offline buffering and reconnect floods, fleet wide reconnection storms, shared credentials, wrong device clocks and stale queued commands.

Test cases for embedded firmware update

Test cases28 cases on power loss mid write, automatic rollback and health confirmation, signature and anti rollback checks, staged rollouts and recovery mode.

Test cases for user profile and account settings

Test cases28 cases on partial saves reported as success, optimistic updates the server rejected, mass assignment through a profile form, avatar content inspection and session invalidation.

Test cases for account deletion and data export

Test cases28 cases on export links that must be authorised and expiring, deletion cascading to storage, caches, logs and processors, grace periods, legal holds and deadlines.

Test cases for consent and cookie management

Test cases28 cases on cookies and tracking requests firing before consent, reject parity with accept, tag manager bypass, withdrawal, cached banners and server side forwarding.

Test cases for notification preferences and delivery

Test cases28 cases on opt outs honoured on one channel and ignored on another, marketing sent as transactional, unsubscribe scope, imports resetting consent and digest timezones.

Test cases for admin impersonation and support access

Test cases28 cases on actions attributed to the customer instead of the admin, credential exposure, chained and upward impersonation, session expiry and immutable access records.

Test cases for audit logs and activity history

Test cases28 cases on forged entries through log injection, immutability and tamper detection, actor attribution across impersonation and jobs, retention and legal holds.

Sources

  • OWASP ASVS verification requirements for authentication, session and access control.
  • WCAG 2.2 the success criteria behind the accessibility cases.
  • WAI-ARIA Authoring Practices expected keyboard and screen reader behaviour for widgets.

Want validation tested where it actually matters?

QAble covers functional, security and accessibility paths together with ISTQB-certified engineers. Start with a free QA audit.

Talk to QA Advisor