What HTTP status code should I return when a client posts bad data (e.g. a string when integer was expected)?
I've been using 400 Bad Request, but as I read over the HTTP docs that seems more applicable to HTTP protocol errors.
I'd like to use a status code so that Flash and AJAX clients can distinguish between success, bad data, and server error without having to parse a response.
This is exactly what 400 is for. Yes, it's used for bad HTTP protocol usage, but it's not exclusively for that purpose.
I'd really be more inclined to trap the bad data back in the browser when the client hits the submit button.
If not, then I'd return 400 because as the standard says:
The request could not be understood by the server due to malformed syntax. The client SHOULD NOT repeat the request without modifications.