customer able to submit an address without selecting a zone from the drop-down, maybe

I have had the following issue twice now (in three months) and wondered if anyone else has experienced it.

Symptoms:

1. customer makes an order and there is no tax applied
   Or
2. The customer has entered an address selecting a country for which zones/states are defined and HAVE to be selected from the drop-down list BUT has not selected a state AND has managed to put something in the (normally hidden) state text field.
   In this case there is no zone_id (=0) associated with the address (in table address_book) but there is text in the entry_state field. This means that if you have a tax zone definition for that country+zone, it will not be applied (as zone_id=0) and so the customer can pay without tax. So, while it would appear that the customer is selecting another country, the correct country_id (that has zones defined) is indeed in the address_book entry.

So it doesn’t add up. I cannot replicate this fault, in my testing the server-side check always blocks the form submission without a zone selected from the drop drown.

Speaking to the customers to figure out what they did is as much use as talking to the cat, no help there. But they both were on pcs and certainly did not have javascript switched off...which should not make any difference anyway as the check is server-side. So, I’d be interested to know if anyone else has experienced this,

thanks Steve

Are you accepting PayPal?

~Melanie

Are you accepting PayPal?
Yes....I realised yesterday that Paypal can insert an address directly...I've now set up an extra field in the address book to record the timestamp and from where the insert was derived for every new address entry.