The (Unofficial) ITWorx Technical Architecture Blog

When to use Page.IsValid ?

Posted by archworx on May 15, 2007

In his blog, Samer Ibrahim  points out a very important issue regarding Page.IsValid usage in pages. He quoted the following paragraph from Fritz Onion’s book  ‘Essential’ :

“As soon as you place a validation control on a page, it is imperative that you check the IsValid flag of the Page class before using any of the data posted by the client.  It is a common misconception that if validation fails on a page, the code for that page will not execute.  On the contrary, the only thing that happens when server-side validation fails is that the IsValid flag of the Page class is set to false, and each validation control that failed renters itself as a visible span so that the error indicator shows up when the page is redisplayed to the user.”

 So if a nice hacker bypasses the javascript validation, the server’s postback code will execute unless you check using safety condition: if(Page.IsValid){//run my code}


3 Responses to “When to use Page.IsValid ?”

  1. Daniel said


    I’m a newbie to ASP.NET who took over a APS.NET project recently.

    The last developer written several Page.IsValid checks but I don’t see a single validation control on the page.

    May I correct to say that without validation control, the Page.IsValid will always be true? And hence, it’s practically useless checking Page.IsValid for my case?


  2. Pole Shift Cover-Up…

    […]When to use Page.IsValid ? « TechnicalArchitectureWorx[…]…

  3. mainstreet web hosting…

    […]When to use Page.IsValid ? « TechnicalArchitectureWorx[…]…

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: