Validator Controls, Client Side? 1

[TomTT]

aspx validation controls suchs as the required field validator are client side validators, right?

That being the case, is aspx generating javascript (jit) on the client side to perform the validation?

If it is, then a client with javascript disabled wouldn't execute the validator code?

If all of that is correct, then I guess you need to re-validate on the server side?

Thank!

 

[ca8msm]

Validation controls use javascript that is contained in the aspnet_client folder.

Personally I always do server side validation as well as client side (it's unlikely that javascript won't be enabled on the client but security wise, you should always validate on the server).


____________________________________________________________

Need help finding an answer?

Try the Search Facility or read FAQ222-2244 on how to get better results.

 

[TomTT]

Thanks for the quick reply. I realize that javascript will usually be enabled, but if it's not, I would be open to passing bad data back to the database......(crash)

Hadn't given it much thought until a discussion of how controls work came up.

You're right about validation server side as well. I am using a Try/Catch to prevent terminal errors, but I guess I also need data quality validation on the server side as well.

Thanks again!!

TT

 

[vbkris]

>>aspx validation controls suchs as the required field validator are client side validators, right?

i have material here that says "The validation controls automatically generate both server side and client side validation code."

Known is handfull, Unknown is worldfull

 

[vbkris]

this is the example i trie out:

http://www.w3schools.com/aspnet/showasp.asp?filename=demo_reqfieldvalidator

Known is handfull, Unknown is worldfull

 

[ca8msm]

I realize that javascript will usually be enabled, but if it's not, I would be open to passing bad data back to the database

Also, if javascript is disabled, a lot of the ASP.NET server controls will behave differently.


____________________________________________________________

Need help finding an answer?

Try the Search Facility or read FAQ222-2244 on how to get better results.

 

[KnotGoblin]

I realize that javascript will usually be enabled, but if it's not, I would be open to passing bad data back to the database......(crash)

Or a malicious person could save the page to their hard drive, change/remove the validation script and submit the form, and like you said pass bad data.

 

[tgreer]

I've done web development since there was a web... prior even to JavaScript. In all that time, I've never once had a user with JavaScript disabled.

The post that says that ASP.NET will generate both client-side and server-side code for validation controls is a bit misleading. It doesn't do both, it does one or the other based on which browser is being used.

There should always be three lines of defense:

1) rudimentary validation, client-side. All required fields have a value, the user isn't re-submitting the same form, etc.

2) stronger validation, server-side. All values are strongly typed, all keys are supplied and/or generated.

3) validation in your database. The best way to do this is with stored procedures.



Thomas D. Greer

http://www.tgreer.com

Providing PostScript & PDF
Training, Development & Consulting

 

[TomTT]

Thanks for all the responses. I think I'm getting it...
Initially, I tended to think validation controls were all I needed to cover my tail. As I picked up more about how they worked I started to see potential problems particularly if someone wanted to do harm.

I think Thomas Greer summed up a realistic approach very well.

I will be looking closely at my server side code with regard to validation and protection of the database.

Thanks again!
Tom T

 

[vbkris]

>>It doesn't do both, it does one or the other based on which browser is being used

i dont understand, isnt that what is required???

if javascript is enabled then that will do, if not then it has to do it server side. isnt that what should happen???

Known is handfull, Unknown is worldfull