validateat="onsubmit" not working 1

[hpvic03]

I've got a simple coldfusion form, with a cfinput type=text and validateat="onsubmit" and validate="email" and required ="yes".

But it will not validate onsubmit, nor onblur. It will only work for onserver. Why is it doing this? Any ideas?

Thanks!

 

[jstreich]

No idea why it wouldn't without seeing each version of the code. They all work for me. Do you have Javascript turned off in your browser?

Validating at anything except server means that people can bypass your validation. JavaScript (JS) is used for all other validateat (with format="HTML") except server, and turning JS off means that they can input (or exclude) whatever data they want regardless of validation rules you set. Even if your using flash or they have Javascript turned on they can generate those HTTP requests with another tool and put anything they want in the POST varible. Aside from the validation, you also need to sanitize against HTML injection (and SQL injection if your using a database).

Also, cfform generates form tags that are not compliant with XHTML 1.0 strict. If you want or have to meet these validations and you want real protection of your data, don't bother with cfform, and use regular html code for your forms.

[plug=shameless]

http://game-master.us/phpx-3.4.0/

[/plug]

 

[hpvic03]

how do you do sql injection protection? i am using a database

 

[cfStarlight]

hpvic03,

One benefit of using cfqueryparam in your queries is protection against sql injection.

http://livedocs.adobe.com/coldfusion/7/htmldocs/00000317.htm

Your forms may not work if cfforms.js is not located at /cfide/scripts/

http://kb.adobe.com/selfservice/viewContent.do?externalId=tn_18653&sliceId=2

 

[hpvic03]

oh, i've been using cfqueryparam most of the time anyway just because my database would not read the the data correctly unless I did that.

i'll check and see where my cfform.js is

thanks starlight

 

[cfStarlight]

You're welcome. You can also use cfform's "ScriptSrc" to point to the location of your cfform.js file.

 

[hpvic03]

awesome, that was the problem. I just copied the CFIDE/scripts directory into every possible folder that could be my webroot (i wasn't sure haha) and now it works.

thanks

 

[jstreich]

<cfqueryparam ... " will sanitize information in queries. You can also add another level of protection by making your database not allow semicolons in a query (and have it add ones at the end of the query automagically), and lastly to protect against HTML/CF injection just make sure to change <'s to &lt;'s.

[plug=shameless]

http://game-master.us/phpx-3.4.0/

[/plug]