Client-Side Form Validation (Security + UX)

// Harden server-side; client is convenience only
document.querySelector('form').addEventListener('submit', (e) => {
  const input = document.getElementById('email');
  const error  = document.getElementById('email-error');
  if (!input.checkValidity()) {
    e.preventDefault();
    input.setAttribute('aria-invalid', 'true');
    error.textContent = input.validationMessage; // browser-native message
  }
});
// Sanitize on input to prevent XSS in error displays
input.addEventListener('input', () => {
  input.setAttribute('aria-invalid', 'false');
  error.textContent = '';
  // Strip any HTML if dynamically setting error text
});

2. CSS Architecture — BEM + ITCSS + Cascade Layers

Custom Properties & Design Tokens

/ @layer order declaration — lowest priority first /
@layer reset, base, layout, components, utilities;
/ ── Settings (Layer: base) ─────────────────── /
:root {
  / Spacing scale (8px base, clamp for fluid) /
  --space-xs:  clamp(4px,  0.5vw,  8px);
  --space-s:   clamp(8px,  1vw,   16px);
  --space-m:   clamp(16px, 2vw,   24px);
  --space-l:   clamp(24px, 3vw,   40px);
  --space-xl:  clamp(40px, 5vw,   64px);
/ Type scale with fluid clamp /
  --fs-body:   clamp(1rem,    0.9rem + 0.5vw, 1.125rem);
  --fs-h1:     clamp(2rem,    1.5rem + 2.5vw, 3.5rem);
  --line-height: 1.5;
/ Color tokens (avoid light/dark in name) /
  --color-bg:        #ffffff;
  --color-text:      #1a1a1a;
  --color-primary:   #2563eb;
  --color-danger:    #dc2626;
  --color-border:    #e5e7eb;
/ Container widths /
  --container-s:  40rem;
  --container-m:  60rem;
  --container-l:  80rem;
}
/ Dark mode via preference + data attribute /
@media (prefers-color-scheme: dark) {
  :root:not([data-theme="light"]) {
    --color-bg:      #0f172a;
    --color-text:    #e2e8f0;
    --color-border:  #334155;
  }
}
[data-theme="dark"] {
  --color-bg:      #0f172a;
  --color-text:    #e2e8f0;
  --color-border:  #334155;
}

BEM Naming with Container Queries

/ ── Component Layer ──────────────────────── /
@layer components {
.card {                         / Block /
  container-type: inline-size;
  container-name: card;
  background: var(--color-bg);
  border: 1px solid var(--color-border);
  border-radius: 0.5rem;
  padding: var(--space-m);
}
  .card__image {                / Element /
    width: 100%;
    aspect-ratio: 16 / 9;
    object-fit: cover;
  }
  .card__title {                / Element /
    font-size: var(--fs-body);
    margin-block-start: var(--space-s);
  }
  .card__action {               / Element /
    margin-block-start: var(--space-s);
  }
  .card--featured .card__title {/ Modifier /
    font-size: var(--fs-h1);
  }
/ Container query: context-aware responsive /
@container card (min-width: 400px) {
  .card {
    display: grid;
    grid-template: "image title"    auto
                   "image action" 1fr / 200px 1fr;
    gap: var(--space-m);
  }
  .card__image  { grid-area: image; }
  .card__title  { grid-area: title; }
  .card__action { grid-area: action; align-self: end; }
}
} / end components layer /

Utility Layer

@layer utilities {
  .u-visually-hidden {
    clip: rect(0 0 0 0);
    clip-path: inset(50%);
    height: 1px;
    overflow: hidden;
    position: absolute;
    white-space: nowrap;
    width: 1px;
  }
  .u-flow >  +  { margin-block-start: var(--space-m); }
}

3. Responsive Design — Mobile-First + Logical Properties

Breakpoint Decision Tree

flowchart TD
    A["Design component"] --> B{"Needs layout change?"}
    B -- No --> C["Fluid: clamp(), %, vw"]
    B -- Yes --> D{"Change at viewport
or container context?"}
    D -- Container --> E["@container query"]
    D -- Viewport --> F{"Breakpoint needed?"}
    F -- "640px+" --> G["@media ≥40em
(small tablet)"]
    F -- "1024px+" --> H["@media ≥64em
(desktop)"]
    F -- "1280px+" --> I["@media ≥80em
(wide)"]
    E --> J["Set container-type on parent"]
    G --> K["Mobile-first: min-width"]
    H --> K
    I --> K

Mobile-First Flexbox → Grid

/ ── Layout Layer ──────────────────────────── /
@layer layout {
  .page {
    display: flex;
    flex-direction: column;
    min-block-size: 100dvh; / dynamic viewport — avoids mobile toolbar /
    padding-inline: var(--space-s);
  }
/ Stack by default, grid on wider viewports /
  .grid {
    display: grid;
    gap: var(--space-m);
    grid-template-columns: 1fr; / mobile: single column /
  }
@media (min-width: 40em) {   / 640px — small tablet /
    .grid { grid-template-columns: repeat(2, 1fr); }
  }
  @media (min-width: 64em) {   / 1024px — desktop /
    .grid { grid-template-columns: repeat(3, 1fr); }
  }
/ Holy Grail layout /
  .holy-grail {
    display: grid;
    grid-template:
      "header"  auto
      "main"    1fr
      "footer"  auto / 1fr;
    min-block-size: 100dvh;
  }
  @media (min-width: 64em) {
    .holy-grail {
      grid-template:
        "header  header"  auto
        "nav     main"    1fr
        "footer  footer"  auto / 15rem 1fr;
    }
  }
/ Logical properties for RTL support /
  .card {
    padding-block: var(--space-m);
    padding-inline: var(--space-s);
    border-inline-start: 4px solid var(--color-primary);
    margin-block-end: var(--space-m);
    inset-inline-start: 0;
  }
}

Fluid Typography & Spacing with clamp()

/ No breakpoint needed — continuous scaling /
h1 {
  font-size: clamp(1.8rem, 1.2rem + 2.5vw, 3.5rem);
  line-height: 1.1;
  text-wrap: balance; / CSS Text Level 4 /
}
p {
  max-inline-size: 65ch;    / optimal reading width /
  text-wrap: pretty;        / prevent orphans /
}

4. Performance — Critical CSS, Fonts, Core Web Vitals

Loading & Rendering Pipeline

flowchart LR
    A["HTML request"] --> B["Parse & build DOM"]
    B --> C{" CSS?"}
    C -- Render-blocking --> D["Fetch + parse CSS → CSSOM"]
    C -- "rel='preload'
async" --> E["Non-blocking fetch"]
    D --> F["DOM + CSSOM → Render Tree"]
    E --> F
    F --> G["Layout → Paint → Composite"]
    B -->|""| H["Preload critical font"]
    H --> I["Font Display: swap → FOUT"]
    subgraph CoreWebVitals["Core Web Vitals Targets"]
      LCP["LCP < 2.5s"]
      INP["INP < 200ms"]
      CLS["CLS < 0.1"]
    end
    G -.-> LCP
    I -.-> CLS

Critical CSS Inlining

Font Loading Strategy

/ Use font-display + preconnect for speed /
@font-face {
  font-family: "Brand Sans";
  src: url("/fonts/brand-sans-var.woff2") format("woff2");
  font-weight: 100 900;            / variable font range /
  font-style: normal;
  font-display: swap;              / FOUT, not FOIT → avoids CLS /
  unicode-range: U+0020-007E;     / subset: basic Latin only /
}

Image Optimization + LCP Fix

  
  
  
  
       fetchpriority="high"               
       decoding="async"
       loading="eager">                   

/ Avoid layout shift from aspect-ratio mismatch /
img {
  max-inline-size: 100%;
  block-size: auto;
  aspect-ratio: 16 / 9;       / matches width/height attr /
  background: var(--color-border); / skeleton while loading /
}

CSS Containment for Render Performance

/ Isolate component subtrees from global layout recalc /
.card            { contain: layout style; }
.sidebar-widget  { contain: content; }   / layout + style + paint /
.hero-background { content-visibility: auto;
                   contain-intrinsic-size: auto 50dvh; }

5. Security — CSP, XSS Prevention, SVG Sanitization

Content Security Policy (CSP)

> Key rule: With CSP, avoid style-src 'unsafe-inline'. Use CSS custom properties and classes instead of inline style="" attributes. If inline styles are unavoidable, use a nonce: style-src 'nonce-abc123' and