MIS 324 -- Professor Sandvig MIS 324 Professor Sandvig 9/20/2018 Forms & Validation MIS 324 Professor Sandvig

Overview What is validation Server & client validation Validation tools in .NET MVC: Model – DataAnnotations View – HTML helpers Controller - model

What is Validation Checking user inputs for: Datatype Length Required Suspicious code: HTML & Javascript

Why Validate Accidental user errors: Malicious hacking attempts Missing fields Invalid values Email, phone, address, etc. Malicious hacking attempts

Accidental user errors Missing fields Invalid credit card Invalid mail address Invalid dates Invalid email

Malicious Attacks Web forms expose your site to the world. Typically writing user inputs to database. Database contains valuable information Customer information Credit card info Etc.

Malicious Attacks Hackers try to exploit security vulnerabilities Sql Injection Enter invalid data to throw exceptions Expose code Expose database info

Counter Measures Check format: Stronger measures: Email, phone, zip, … Send email with code Send text message Validate address against database Checksum: Credit cards WWU student Id ISBNs

Client and Server validation Browser HTML5 and JavaScript Advantage: Fast, no trip required to server Disadvantage: Easily circumvented Save form to desktop, remove validation, submit

Server Validation Form data submitted to server Data validated on server Advantage: Secure Disadvantage: Requires roundtrip to server More complicated to implement

.NET MVC Validation Provides tools for easy validation: Client: Javascript & HTML5 Server: rechecks, rejects invalid data

.NET MVC Validation DataAnnotations Decorate model with validation attributes Required Data type length Credit card Etc. Easy to implement both client and server validation

.Net MVC Validation Validation Attributes: Required StringLength Range RegularExpression CreditCard CustomValidation EmailAddress FileExtension MaxLength MinLength Phone

.NET MVC Validation Model: public class Student { public int StudentId { get; set; } [Required] public string StudentName { get; set; } [Range(5,50)] public int Age { get; set; } }

.NET MVC Validation View: Client-side validation: Include script libraries

.NET MVC Validation Model: Server-side validation: Example: Calculator/MultiplyCalc

Summary Form Validation Important Time consuming Accidental errors Malicious attacks Time consuming .NET MVC provides convenient tools