You’ve seen <cfinput> used to validate on the server and on the client. So far we used one or the other, but it need not be an either/or proposition. In fact, <cfinput> supports the use of multiple validation types at once. All you need to do is specify the types delimited by commas.
So, to validate the UserID field using masks, client-side validation, and server-side validation, you could do the following:
<cfinput type="text" name="LoginID" maxlength="5" required="yes" mask="99999" message="A valid numeric ID is required!" validate="integer" validateAt="onSubmit,onServer">