Friday, January 26, 2007

Group Validators in ASP.NET 2.0

A key rule for writing more secure applications is to get the data right before you use it. New features in ASP.NET 2.0 provide more flexibility for validating user input.


Getting the data right requires you to apply a validation step to any external input. In ASP.NET, validation controls provide an easy-to-use mechanism to perform a variety of validation tasks, including testing for valid types, values within a given range, or required fields. Validation controls are server controls that perform a particular task on the input of a given input control in the same page. ASP.NET defines validators to check a field for nullness, against a particular range of values or a regular expression. The association between the validator and the monitored control is purely declarative and set mostly at design time.

All validators defined on a page are automatically grouped in the Validators collection of the Page class. You can validate input controls all in a single shot using the Validate method in the Page class or individually by calling the Validate method on individual validator controls. The Validate method sets the IsValid property both on the page and on the individual validator. The IsValid property indicates whether the user’s entries match the requirements of the validators. Other than explicitly using the Validate method, the user’s entry is also automatically validated whenever the page posts back.

In ASP.NET 1.x, control validation occurs in an all-or-nothing kind of way. For example, if you have a set of input and validation controls and two buttons on the form, clicking either button will always validate all controls. In other words, there’s no way to validate some controls when one button is clicked, and some others when another button is clicked. The CausesValidation property on button controls allows you to disable validation on a button, but that is another story. What is missing is the ability to do validation on a group of controls. This is just what the ValidationGroup property provides in ASP.NET 2.0. The property is available on validators, input, and button controls.

Using the ValidationGroup property is simple: Just define it for all the validation controls that you want to group together, and then assign the same name to the ValidationGroup property of the button that you want to fire the validation.

<asp:textbox runat="server" id="TextBox1">
<asp:RequiredFieldValidator runat="server"
ValidationGroup="Group1"
ControlToValidate="TextBox1"
ErrorMessage="TextBox1 is mandatory" />
<asp:textbox runat="server" id="TextBox2">
<asp:RequiredFieldValidator runat="server"
ValidationGroup="Group2"
ControlToValidate="TextBox2"
ErrorMessage="TextBox2 is mandatory" />
<asp:button runat="server" text="Group1" validationgroup="Group1">
<asp:button runat="server" text="Group2" validationgroup="Group2">
The two RequiredFieldValidator controls belong to distinct validation groups—Group1 and Group2. The first button validates only the controls defined within Group1; the second button takes care of the input associated with Group2. In this way, the validation process can be made as granular as needed.

The validation group feature gets especially helpful when combined with cross-page postbacks—a new ASP.NET 2.0 feature. Cross-page postback allows a button to post the contents of the current form to another page in a certain way, overriding the single-form model of ASP.NET. Imagine you have a search box in your page, and you want to post its contents directly to a search page without passing through the classic postback mechanism and an additional redirect. Validation groups allow you to check only the contents of the search textbox prior to posting to the search page.