Advise on validation techniques???

[MrNorth]

Im writing a white paper for my company about how to handle page validations in asp.net pages. Our problem is that we don't have a common strategy for handling validations... some devs use server based validation methods, some use the built in client side validations.

Which do YOU use? And what is the strategy behind your choice?

Im also puzzled about how to use the built in validation controls when validating datagrids. How do you handle datagrid validations (template columsn with textboxes etc)...

note, is for asp 1.1 not whitbey...

/Henrik

[plenderj]

Heh just typed basically the same response in another thread in the ASP.NET forum

The way I do it is as follows. In page_load for every page, I check if Session("UserName") = vbNullString. If it is, then the user's session has expired and redirect them to the logon page. Otherwise, check that Session("UserLevel") is high enough to be viewing the current page.

When the user is logging in they provide their email address and password. These are checked against entries in the DB. If the user authenticates correctly, they're provided with a user level. This is simply a numeric field stored in the DB.

Then for all menu items throughout the application, they check the Session("UserLevel") to see if the user should have access to certain areas of the app. Simple as that

... also see my post here: http://www.vbforums.com/showthread.php?t=325524

[ssmantha]

hi,

I think the datagrid embedded validations can be done by placing the server side validators in the template coloums along with the controil and set their control to validate property with the corresponding control's id..

otherwise if you prefer javascript the get the client id of the control and then write the code for it...accordingly...

regards,
ssmantha

[MrNorth]

Thanks for the responses. I think the term "validation" is a bit confusing here. WHat I meant with validation is to ensure that the user input in the form is within certain preset rules. LIke some fields only allow number etc...

And some value perhaps need to match with certain business logic before proceeding.

What I was looking for was a standardized way to handle these form validations.. Where should the developer start? WIth the built in validation controls and proceed to make custom validators if needed? Or do it entirely server side using a custom designed base validation class???

Oh, about validating INSIDE a datagrid using validation controls... does it really work??? Has anyone tried? I will do so, when I get back to work. I always figured the control ids will be screwed up when binding the grid... hehe

cya
Henrik

[nemaroller]

It is IDEAL to do both client-side and server side validation - because you can only trust the client as far as you can throw them.

Now, you might not have big security policies at your workplace - but any developer caught using just client-side validation would be replaced by end of day.

[MrNorth]

Oki

Btw I tried the validation controls on the datagrid template columns... and it worked... but the grid turned out extremly ugly.... because it has to allow room for the validation control as well as the textbox... avoid.. hehe

/Henrik

[mendhak]

I don't use the built in validation controls because there are times when it just won't work with anything other than IE 6. That's simply annoying. I prefer to do it by myself, server side.

[MrNorth]

If you design your asp.net applications completly object oriented, which class(es) do you assign the responsibility to validate input? Do you use an interface, abstract class?

Oh, btw can anyone recommend a good book on how to design OO databasedriven asp.net apps? I do it pretty good now, but I wanna learn more...

/Henrik

[nemaroller]

I think object oriented programming is great. But I wouldn't waste time developing a class to handle it unless you're going to be re-using parts of the site over and over in future sites.

Usually, validation should be internal to whatever class needs to put the data into a database - ie a registration class.