@mkoek @simevidas Disagree. maxlength should be used to help people avoid inputting strings that are too long.

But you should never depend on web form validations and restrictions anywhere else, especially server-side. As you say, they are trivially bypassed.

Saying not to use maxlength is like saying to not use dropdown menus because the user could alter the menu or the selected value before submitting the form.