diff --git a/server.py b/server.py
index 4084baeac..d407bbb08 100644
--- a/server.py
+++ b/server.py
@@ -46,6 +46,9 @@ def purchasePlaces():
     competition = [c for c in competitions if c['name'] == request.form['competition']][0]
     club = [c for c in clubs if c['name'] == request.form['club']][0]
     placesRequired = int(request.form['places'])
+    if placesRequired > 12:
+        flash("you can not book more than 12 places")
+        return render_template('welcome.html', club=club, competitions=competitions)
     competition['numberOfPlaces'] = int(competition['numberOfPlaces'])-placesRequired
     flash('Great-booking complete!')
     return render_template('welcome.html', club=club, competitions=competitions)
diff --git a/templates/booking.html b/templates/booking.html
index 06ae1156c..1f0f01c62 100644
--- a/templates/booking.html
+++ b/templates/booking.html
@@ -10,7 +10,7 @@ <h2>{{competition['name']}}</h2>
     <form action="/purchasePlaces" method="post">
         <input type="hidden" name="club" value="{{club['name']}}">
         <input type="hidden" name="competition" value="{{competition['name']}}">
-        <label for="places">How many places?</label><input type="number" name="places" id=""/>
+        <label for="places">How many places?</label><input type="number" min="0" max="12" name="places" id=""/>
         <button type="submit">Book</button>
     </form>
 </body>
diff --git a/test/tests_unitaires/test_server.py b/test/tests_unitaires/test_server.py
new file mode 100644
index 000000000..ce9b3f0ad
--- /dev/null
+++ b/test/tests_unitaires/test_server.py
@@ -0,0 +1,29 @@
+import pytest
+from server import app
+
+@pytest.fixture
+def client():
+    app.config['TESTING'] = True
+    app.secret_key = "test"
+    with app.test_client() as client:
+        yield client
+
+def test_booking_more_than_12_places(client, monkeypatch):
+    test_club = {"name": "Test Club", "email": "test@club.com", "points": "50"}
+    test_competition = {"name": "Test Competition", "numberOfPlaces": "25", "date": "2025-12-12 10:00:00"}
+
+    monkeypatch.setattr("server.clubs", [test_club])
+    monkeypatch.setattr("server.competitions", [test_competition])
+
+    response = client.post("/purchasePlaces", data={
+        "competition": "Test Competition",
+        "club": "Test Club",
+        "places": "13"  # > 12 → doit déclencher le bloc
+    }, follow_redirects=True)
+
+    # Vérifie que le message flash est bien là
+    assert b"you can not book more than 12 places" in response.data
+
+    # Vérifie que les données n'ont pas été modifiées
+    assert test_competition["numberOfPlaces"] == "25"
+    assert test_club["points"] == "50"