User input validation in ASP +

Download the pdc_userinput.exe sample file (44 KB ).

Content:

• Introduction
• Problem
• Target
• Solution Overview
• Client features
• What Is A validator?
• Validator demo
• Not voluntary
• Regularization
• Compare one by one
• Conform to habits
• Conclusion

Introduction

Verifying user input is common in Web-based applications. In order to develop applications, developers often spend a lot of time in this work and edit a lot of code, much more than we want. In the process of building an ASP + Page architecture, it is important to make input verification easier than before.

Problem

In HTML 3.2, data verification is a difficult process. After each request is received, you need to write code to check the input and return the user's error to the page to help the user correctly fill in the verification form. This is a complex process for end users, developers, and servers.

Dthml and script language improve the situation. When an input error occurs, they can immediately report to the user and prevent the user from publishing the page before the modification. However, it is almost impossible to ensure that every user of the site has the script design environment required. This usually means that if you want to use scripts to improve the web page interface, you must write the same verification logic twice on the client and server to prevent the client code from being executed.

Target

For verification, our goal is:

• Provides components for the data input page to complete 90% or more typical verification tasks.

• Allow these components to perform full script-based verification on new browsers. When necessary, these browsers can effectively return to pure HTML 3.2 server-based verification.
• Provides a flexible API to easily complete any verification tasks not included in the component.

We visited a large number of actual web pages to determine the scenarios that these components should be able to process. Our goal is to greatly reduce verification code in future applications.

Solution Overview

The validators control is a major part of this solution. The validator is a visual ASP + control that is used to check the specific verification conditions of another control. It usually appears in front of the user in the form of a piece of text, according to whether the control it is checking has an error to display or hide. It can also be an image or even invisible, but still do useful work. There are five validators that can execute different types of check tasks.

Another element of the solution is the validationsummary control. The big data input page usually has a list of all error areas. Validationsummary automatically collects and generates content from the validators control on the page.

The last element of the solution is the page object itself. It displays the most important "isvalid" attribute, which can be checked in the server code and determined whether the user input is correct.

Client features

Most websites perform server-based checks on servers, and you have to write server-based checks for clients without scripts. Therefore, it is difficult to determine whether to rewrite all the checks for all fat clients.

Verification Controls change this because almost all repeated logic is encapsulated in the control. If a client using IE 4.0 or an updated version uses your page, it can perform the same verification as on the server without writing any special client scripts.

The client verification process includes the following features:

• The error message appears or disappears immediately after the illegal input is typed or corrected. This instant feedback makes it easier to correct incorrect input.

• "Return" when an error can be detected on the client can be avoided, which saves the user time and reduces the number of clicks on the server.
• If validationsummary detects an error, it only updates itself and does not return it.
• If an error occurs, validationsummary can display a message box to the user.
• The client logic is completely contained in a JScript library, so ActiveX components or Java applets are not used.
• You can also use Vbscript to check local dates and compare numbers.
• Displays an object model on the client to enhance client-side verification and behavior.

What is a validators?

To effectively use the validators, it is helpful to give a strict definition. Let's refine the previous definition:

"Verification is a control that checks for certain types of error conditions in an input control and displays a description of the problem ."

This is an important definition, because it means that you often need to use multiple validators controls for each input control.

For example, if you want to check whether the user input in the text box is (a) not empty, (B) valid date in a specific range, or (c) less than the date in the input control of another text, you may need to use three validators. This may seem complicated, but remember that this is helpful to users. Three different text descriptions may be used for all these situations.

The following lists several different validators:

Requiredfieldvalidator	Check whether the user has entered or selected any content
Regularexpressionvalidator	Check user input based on the Rule expression. This process allows you to perform many types of checks, such as ZIP code and phone numbers.
Comparevalidator	Compare the input control with a fixed value or another input control. For example, it can be used in the password verification field. It can also be used to compare the input date and number.
Rangevalidator	Similar to comparevalidator, it is used to check whether the input is between two values or other input control values.
Customvalidator	Allow users to write their own code to join the verification framework.

Validator demo

To demonstrate the verification task, we will outline the process of adding verification to an existing page. The following are examples of required conditions:

Compile a web page to collect new user IDs and passwords. The User ID must be 6-10 characters long and is not in use. The password must contain 4-12 letters, with at least one digit and a character in "@#% % ^. The user must enter the password again to ensure that the input is correct.

I will start with an HTML page, which has been converted to the ASP + Page framework to the minimum extent.

The page conversion process includes the following steps:

1. Convert the extended extension Extension from ". html" or ". asp" to ". aspx ".

2. Change the form template and all input tags to "runat = server ".
3. Use "ID" instead of "name ".

Start code:

<HTML> 

Start page:

Not voluntary

First, we must force all fields to be filled.

Add requiredfieldvalidator before each field. If the input field is blank, an asterisk (*) is displayed before the field and a text error is reported in the summary area. The following describes how to add the requiredfieldvalidator control to the user ID field:

<Tr> <TD> <asp: requiredfieldvalidator runat = server controltovalidate = txtname errormessage = "User ID is required. "> * </ASP: requiredfieldvalidator> </TD> <TD> User ID: </TD> <input type = text runat = server id = txtname> </TD> </tr>

If the input is null, it is displayed next to the tag *. Error messages are reported in the summary. The controltovalidate attribute specifies the ID of the control to be verified. The last step is to add a verification summary to the top of the page, as shown below:

<Asp: validationsummary runat = server headertext = This page has an error:/>

The page is as follows:

Regularization

In the next step, we need to emphasize the requirements of the user ID and password fields. Use the regularexpressionvalidator control for these fields. Rule expressions are very valid in the Concise Expression check of such information, including the zip code, phone number, and email address.

The following shows how to specify the user ID restriction:

<TD> <input type = text runat = server id = txtname> <asp: regularexpressionvalidator runat = server controltovalidate = "txtname" errormesage = "the password must consist of 6 to 10 letters. "Validationexpression =" [A-Za-Z] {6, 10} "/> </TD>

Note that in this example, we do not specify any internal content in the tag. Internal text is equivalent to the "text attribute" of the control ". If it is empty, the error information is displayed in the control's position, and it also appears in the abstract.

You can use the following two validators to check the password. If you use multiple validators, the input is valid only when they all match.

<Asp: regularexpressionvalidator runat = server display = dynamic controltovalidate = "txtpword" errormessage = "the password must contain one of @ # $ % ^. "Validationexpression = ". * [@ # $ % ^ & */]. * "/> <asp: regularexpressionvalidator runat = server display = dynamic controltovalidate =" txtpword "errormessage =" the password must be 4-12 non-blank letters. "Validationexpression =" [/s {4, 12} "/>

This is a form with an expression in the operation.

Compare one by one

We need to confirm that the re-input field of the Password Matches the password. You need to use the comparevalidator control to complete this operation. Because it can process two input controls at the same time.

<Asp: comparevalidator runat = server controltovalidate = txtrepword controltocompare = txtpword errormessage = "the password does not match. "/>

By default, comparevalidator only performs simple string matching and comparison. If necessary, it can perform more complex comparisons involving dates and numbers.

Conform to habits

The last thing we need to check is that the name is not used in the hypothetical site. This will continue to look for some data on the server. To simulate this operation, I create a dummy function in the code segment on the server to check whether the first character is not "". The following visual basic functions are defined on the page:

public function CheckID(source as Object, value as String) as Boolean    return value.substring(0, 1).tolower() <> "a"end function

To call this function, I will add a customvalidator, which is used to call the developer's code to perform the check. The following is its statement:

<Asp: customvalidator runat = server controltovalidate = "txtname" errormessage = "ID" is already in use. "Onservervalidationfunction =" checkid "/>

It can also call custom functions in the client script, although this is not practical if it has to find values in the database. On a client with a script, all other validators can submit the job only after performing a check on the client. If such errors are detected only on the server, these errors are reported to the user's return page.

Conclusion

Now, the only thing left is to use the data that has been carefully verified. All you need to do is check the isvalid attribute on the page to determine whether database updates can be performed. The processing program you submit may be in the following format:

Public sub onsubmit (source as object, e as eventargs) If page. isvalid then 'Now we can execute transactions. End ifend sub

As you can see, this handler allows the data input page to contain the code specific to your application, rather than all the code to handle general input checks.

The following are other information about the final activity page: