None of HTML's new form attributes replace server side validation (which is annoying since you end up repeating code and having slight differences), however it'

None of HTML's new form attributes replace server side validation (which is annoying since you end up repeating code and having slight differences), however it's a good start. With CORS and CSRF tokens, it would cut down on accidental issues – which for most sites is a bigger deal than malicious activity.