TechnicalArchitectureWorx

The (Unofficial) ITWorx Technical Architecture Blog

When to use Page.IsValid ?

Posted by archworx on May 15, 2007

In his asp.net blog http://weblogs.asp.net/sibrahim/archive/2003/06/15/8723.aspx, Samer Ibrahim  points out a very important issue regarding Page.IsValid usage in asp.net pages. He quoted the following paragraph from Fritz Onion’s book  ‘Essential asp.net’ :

“As soon as you place a validation control on a page, it is imperative that you check the IsValid flag of the Page class before using any of the data posted by the client.  It is a common misconception that if validation fails on a page, the code for that page will not execute.  On the contrary, the only thing that happens when server-side validation fails is that the IsValid flag of the Page class is set to false, and each validation control that failed renters itself as a visible span so that the error indicator shows up when the page is redisplayed to the user.”

 So if a nice hacker bypasses the javascript validation, the server’s postback code will execute unless you check using safety condition: if(Page.IsValid){//run my code}

3 Responses to “When to use Page.IsValid ?”

  1. Daniel said

    Hi,

    I’m a newbie to ASP.NET who took over a APS.NET project recently.

    The last developer written several Page.IsValid checks but I don’t see a single validation control on the page.

    May I correct to say that without validation control, the Page.IsValid will always be true? And hence, it’s practically useless checking Page.IsValid for my case?

    Regards,
    Daniel

  2. Pole Shift Cover-Up…

    […]When to use Page.IsValid ? « TechnicalArchitectureWorx[…]…

  3. mainstreet web hosting…

    […]When to use Page.IsValid ? « TechnicalArchitectureWorx[…]…

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: