Chapter 9 Validating User Input Objectives What user

Chapter 9 Validating User Input

Objectives • What user input is and why it’s important to validate it • What ASP. NET 4. 5. 1 has to offer to aid you in validating user input • How to work with the built-in validation controls and how tocreate solutions that are not supported out of the box • How to send e-mail using ASP. NET • How to read text files

Obtaining Data from the user • • Data is obtained from the user to the server side through different ways. To common ways are using a GET and POST • GET sends data through to the actual address via the Querytring • POST sends data through the body of the request of the page The Request Object contains a Query. String property which shows what is sent over the Query. String http: //www. Planet. Wrox. com/Reviews/View. Details. aspx? Review. Id=34&Category. Id =3 • The question mark is used to separate the query string from the rest of the address, and the query string itself consists of name/value pairs separated by an ampersand (&). The names and values in turn are separated by theequals symbol (=).

Obtaining Data from the user • To obtain values from the Query. String, you can use the Get Method in the Request object: // Assigns the value 34 to the review. Id variable int review. Id = Convert. To. Int 32(Request. Query. String. Get("Review. Id")); // Assigns the value 3 to the category. Id variable int category. Id = Convert. To. Int 32(Request. Query. String. Get("Category. Id")); • How can we be sure that the data we obtain from the user is going to be convert correctly to an “Int” in this case? What’s to prevent the user from using an alphabetic character?

Validation • • To protect your application you should always perform some validation of the data. • Client Side Validation: This is done mostly for the convenience of the user. It saves them a poastback trip to find out that their input is incorrect. • Server Side Validation: This is where the validation should occur to truly be able to protect your website. THIS IS A MUST HAVE. Why don’t we rely on just client side validation? • Client side validation is done by Javascript, and this can be easily tampered with by the user. Modern browsers allow uses to explore the client side code and make changes to it.

ASP. NET Validation Controls • . NET provides several validation controls: • Compare. Validator • Custom. Validator: Uses a custom logic to validate • Range. Validator: Evaluates a range • Regular. Expression. Validator: Evaluates against a reg expression • Required. Field. Validator: Makes sure the field has been populated • Validation. Summary: Provides feedback to users about errors

Required Field Validator • Validation Controls can check in the client side and the server side. • Required Field Validator: • Add the control to the ASPX page <asp: Required. Field. Validator ID="Req. Val 1" runat="server" Control. To. Validate="Your. Name“ Error. Message="Enter your name" /> • The Control. To. Validate tag points to another control which will be bound to this validation • The Error Message is the message displayed to the user if this validation fails. • You can use a CSS class to decorate the error message and the Text Field to denote the field as required if the user doesn’t fill in any data

Required Field Validator • Create a class to drive the design of the error message. Error. Message { color: Red; } • Whenever you try to submit the form to the server by clicking the Send button, the validation control checks the control it is attached to. When the text box is still empty, the asterisk from its Text property is shown (formatted with the Error. Message CSS class), and the form is not submitted.

HTML 5 Input Data Types • ASP. NET Textboxes support these types with the Text. Mode Attribute. • <asp: Text. Box runat="server" ID="Email" Text. Mode="Email" />

HTML 5 Input Data Types • When Rendered the following HTML is outputted <input name="Email" type="email" id="Email" /> • These data types are supported by most modern browsers and have additional functionality that affects behavior on smartphones or tables. • See these when possible as browsers get more HTML 5 support. • Demo: • http: //imar. spaanjaars. com/demos/html 5. aspx

Common Validation Control Properties • These are the common properties of the Validation controls since they inherit from the same base class.

Common Validation Control Properties

Difference between Text and Error. Message • Both appear to do the same thing, but they are different. • When you set both the properties at the same time, the validation control displays the Text property, whereas the Validation. Summary uses the Error. Message. • The Text property sets the “*” while Validation. Summary prints the Error. Message.

Range Validator • This validator allows to check for a certain range and can check strings, numbers, dates and currencies <asp: Range. Validator ID="Range. Validator 1" runat="server" Control. To. Validate="Rate" Error. Message="Enter a number between 1 and 10" Maximum. Value="10" Minimum. Value="1" Type="Integer" />

Regular Expression Validator • Validates against a regular expression, which is a powerful rule that ca be created to specify a particular pattern. • Some built-in expression in Visual Studio are email and Zip. <asp: Regular. Expression. Validator ID="Regular. Expression. Validator 1" runat="server" Control. To. Validate="Email" Error. Message="Enter a valid e-mail address" Validation. Expression="w+([-+. ']w+)*@w+([-. ]w+)*. w+([-. ]w+)*" />

Compare Validator • Compares the value of one control to another or a constant. For example can be used to compare two password fields to make sure they match.

Compare Validator • Compare two textbox passwords. • One textbox has the id of “Password” • The other textbox has the id of “Confirm. Password” • Since no operator is set, it defaults to Equality comparison. <asp: Compare. Validator ID="Compare. Validator 1" runat="server" Control. To. Compare="Confirm. Password" Control. To. Validate="Password" Error. Message="Your passwords don't match" />

Custom Validator and Validation Summary • With the customer validator, you can define client side validation with your on method and server side validation with your own server side method. • <asp: Custom. Validator ID="Custom. Validator 1" runat="server" Error. Message="Enter your home or business phone number" Client. Validation. Function="validate. Phone. Numbers“ On. Server. Validate="Custom. Validator 1_Server. Validate“ Display="Dynamic">*</asp: Custom. Validator> • The Server Side validate tests the following protected void Custom. Validator 1_Server. Validate(object source, Server. Validate. Event. Args args) { if (!string. Is. Null. Or. Empty(Phone. Home. Text) || !string. Is. Null. Or. Empty(Phone. Business. Text)) { args. Is. Valid = true; } else { args. Is. Valid = false; } }

Custom Validator and Validation Summary • The Client Side validation script is the following: • • • <script> function validate. Phone. Numbers(source, args) { • • } </script> • The tests check that either the home or business phone is populated. var phone. Home = document. get. Element. By. Id('<%= Phone. Home. Client. ID %>'); var phone. Business = document. get. Element. By. Id('<%= Phone. Business. Client. ID %>'); if (phone. Home. value != '' || phone. Business. value != '') { args. Is. Valid = true; } else { args. Is. Valid = false; }

Validation Summary Control • The Validation. Summary control provides the user with a list of errors that it retrieves from the individual validation control’s Error. Message properties. • It can display these errors in three different ways: using a list embedded in the page, using a Java. Script alert box, or using both at the same time. • You control this setting with the Show. Message. Box and Show. Summary properties. Additionally, the Display. Mode property enables you to change the way the list of errors is presented. • The default setting is Bullet. List where each error is an item in a bulleted list, but other options are List (without bullets) and Single. Paragraph.

Validation Summary Control • If we change Show. Message. Box to True, we get an Alert Box with the error messages.

Request Validation • By default, ASP. NET throws an exception if someone tries to add HTML syntax inside a control to prevent malicious code.

Request Validation • You can disable this to allow users to enter HTML syntax. • At the Page level (Allows all controls to accommodate HTML syntax): <%@ Page. . Inherits="Contact" Title="Contact Us" Validate. Request="False" %> • • At a Control level: • The Control class contains the Validate. Request. Mode property, when set to “disabled” it accepts HTML. • If you allow HTML, you must sanitize the data to remove dangerous pieces of code, such as removing <script> elements. When displaying the data on a page, you could use a Literal control, with its Mode set to Encode in order for the HTML to be encoded and rendered harmless. With this property set, the text is displayed verbatim, without being interpreted as HTML or Java. Script.

Sending Email from Your Website • Inside the System. Net. Mail namespace you find a number of classes that make it easy to create and send e-mail messages.

Configuring the mail server • To Send Email you need to have the SMTP Server configuration which can be setup in web. config of the site. <system. net> <mail. Settings> <smtp delivery. Method="Network" from="Your Name < you@example. com> "> <network host="smtp. example. com" /> </smtp> </mail. Settings> </system. net>. . . </configuration> • Other configurations require other settings such as username, password, or SSL.

Creating a Mail Message • To send an email, you need to create a Mail. Message Object and set the properties of the message, such as To and From address, Body and Subject. • Once the Mail Message is formed, it is sent to an Smtp. Client Object. protected void Page_Load(object sender, Event. Args e) { Mail. Message my. Message = new Mail. Message(); my. Message. Subject = "Test Message"; my. Message. Body = "Hello world, from Planet Wrox"; my. Message. From = new Mail. Address("you@example. com", "Sender Name"); my. Message. To. Add(new Mail. Address("you@example. com", "Receiver Name")); } • Smtp. Client my. Smtp. Client = new Smtp. Client(); my. Smtp. Client. Send(my. Message); When the Send method is called, the Smtp. Client scans the Web. config file for a configured SMTP server or local drop folder. It then contacts that server and delivers the message or saves it locally.

Reading from Text Files • The File Class in System. IO is available in. NET to be able to perform operation on files. • File is a static class, so you don’t have to instantiate, you can call the methods directly. • string my. Contents = System. IO. File. Read. All. Text(@"C: My. File. txt"); • Using the @ symbol tells the compiler that it should treat each backslash it finds as literal, ignoring the special meaning of the character.

File Class • The following are common methods that allow you to work with a file

File Class • Create a text file with some sample text in it and call it My. Text. txt • In the code behind of a page, add some code to read from the file using System. IO; // Provides access to the File class for reading the file using System. Net. Mail; // Provides access to the various mail related classes string file. Name = Server. Map. Path("~/App_Data/My. Text. txt"); string file. Content = File. Read. All. Text(file. Name); • Server. Map. Path("~/App_Data/My. Text. txt") returns a physical path such as C: Beg. ASPNETSiteApp_DataMy. Text. txt. • This code finds your My. Text. txt file in the App_Data folder of your website and loads the contents of the file into a string object named file. Content.

Try it Out • Pg. 303 • Pg. 311 • Pg. 315 • Pg. 324 • Pg. 328

Summary • In this chapter we covered: • What user input is and why it’s important to validate it • What ASP. NET 4. 5. 1 has to offer to aid you in validating user input • How to work with the built-in validation controls and how tocreate solutions that are not supported out of the box • How to send e-mail using ASP. NET • How to read text files