ColdFusion Form Handling Michael Smith, President TeraTech, Inc ColdFusion, Database & VB custom development http://www.teratech.com 800-447-9120 http://www.teratech.com

Introduction Michael Smith President TeraTech Run MDCFUG CFUN-2k, CF2001 CF programmer and teacher Articles in CFDJ, CFAdvisor, Fusion Authority http://www.teratech.com

Why are Forms important? Valid data! Make site easy to use – or not! Layout indicates required fields Section 508 compliant Security – eg SQL add in, fake form submits and URL http://www.teratech.com

Form basics <FORM METHOD ACTION Submits via header or URL CF creates Form scope Structure Action to other form, self, email, JavaScript Other elements can submit via JavaScript – or auto self submit on timer! http://www.teratech.com

Validation Data type In range Text length Lookup lists Radio button or check box Credit card email Field by field vs form wide validation http://www.teratech.com

CFFORM CFINPUT CFSELECT CFTEXTINPUT CFSLIDER CFGRID CFTREE Onvalidate and and onerror extensions http://www.teratech.com

CFFORM pros and cons Creates JavaScript validation code Immediate feedback No refocus after error CF 5 big download Phone validation a bit strong Dreamweaver form elements Not 508 compliant http://www.teratech.com

_ field validation Hidden form fields _date, _required, _eurodate, _float, _integer, _range, _time <INPUT TYPE=“hidden” NAME=“mydatafield_required” VALUE=“Message” Works even if javascript turned off Can not use names with _date in them! Fake submit security bypass! Doesn’t work with GET http://www.teratech.com

JavaScript validations Onsubmit function Totally custom – eg multiple fields Harder to write and maintain Security issue Save server load Not 508 compliant Browser version dependent http://www.teratech.com

Submit page validations Most secure Most flexible More complex CFIF Table look ups Clean up data with val() and CFQUERYPARAM CGI.HTTP_REFERER http://www.teratech.com

Traps Check data type CFQUERY WHERE variables CFINPUT and CFUPDATE – beware Check boxes don’t exist Wacky characters like ‘ Submit page run directly File upload – must use multipart form <input type="File“ name=“file”> ENCTYPE”multipart/form-data” http://www.teratech.com

Where to submit to Method POST vs GET (default!) Myform_sub.cfm Self – use action = #CGI.SCRIPT_NAME#?#CGI.QUERY_STRING# Hidden fields for arguments Redisplay entered info plus error message Size issue with Get, much bigger with POST (text area may fill it!) http://www.teratech.com

Fusebox submit to index.cfm with fuse that: fusebox CF_REUSEFORM validates the data. If valid Insert SQL Else CFLOCATION to form with data filled out fusebox CF_REUSEFORM http://www.teratech.com

Credit card issues Don’t resubmit Review field page before processing Insert data before sending to credit card site in case of failure. http://www.teratech.com

References Ben Forta “Web Application Construction Kit” Chap 12, 14, 15, 23 Kristin Motlagh “Mastering CF” Chap 14, 15 Builder.com form validation basics http://www.teratech.com

Questions? Ask now… MDCFUG-L list … or email michael@teratech.com http://www.teratech.com

Sample code to cut and paste <!--- || BEGIN FUSEDOC || || Properties || Name: act_validate_new_account_data.cfm Author: || Responsibilities || I define the application wide parameters for the site. || Attributes || || END FUSEDOC ||---> || General || Name: Author: Martin Cadirola Copyright (c) 2000, 2001. All rights reserved Email: martin@ecotronics.com || History || || Purpose || This fuse is target of in_SubmitJob and err_SubmitJob. First thing is to convert all form fields to session variables, then work from there... Data that is not valid gets cleared so that err_SubmitJob shows erroneous data blank * roleID , a string. single value * position_types , a comma separated list * locations , a comma separated list * title * company_website * salaryrange_low * salaryrange_high * poc_phone * poc_fax * poc_email * astd_firstname * astd_lastname * astd_company * astd_phone * astd_email <!--- CONVERT ALL FORM VARIABLES INTO SESSION VARIABLES ---> <cf_FormFields2SessionVars> <!--- INITIALIZE VALIDATION VARIABLES: FLAG AND MSG ---> <cfset Data_Not_Valid = "False"> <cfset CLIENT.msgErrorCreateEditAccount = "" > <!--- If this user is a doctor, make sure the required fields are there For doctors, we need: DEA# EMAIL SPECIALTY STATE ---> <cfif isDefined("attributes.isdoctor") and attributes.isdoctor is "on"> <cfif attributes.client_DEA_number lt 5> <cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Please enter your DEA ##" & "<br>"> <cfset Data_Not_Valid = "True"> </cfif> <cfif Data_not_valid> <cfset CLIENT.msgErrorCreateEditAccount = "For doctors, we ask that you please fill out the following fields:<br>   * DEA##<br>   * EMAIL<br>   * SPECIALTY<br>   * STATE<br> #CLIENT.msgErrorCreateEditAccount#"> <!--- CHECK FOR TITLE ---> <!--- <cfif CLIENT.client_first_name is ""> <cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "First Name" & "<br>"> </cfif> ---> <cfif CLIENT.client_last_name is ""> <cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Last Name" & "<br>"> <!--- <cfif CLIENT.client_address1 is ""> <cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Address" & "<br>"> <!--- <cfif CLIENT.client_city is ""> <cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "City" & "<br>"> <!--- <cfif CLIENT.client_postal_code is ""> <cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Postal Code" & "<br>"> <cfif CLIENT.client_password is "" OR CLIENT.client_password_check is "" or CLIENT.client_password is NOT CLIENT.client_password_check> <cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Unable to validate passwords" & "<br>"> <cfif CLIENT.client_country_id is "233" and CLIENT.client_state_id is 1> <cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Please select your state" & "<br>"> <cfif CLIENT.client_country_id is "39" and CLIENT.client_state_id is 1> <cfif CLIENT.client_state_id is not 1> <CFIF CLIENT.client_country_id is not "39" AND CLIENT.client_country_id is not "233"> <cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "If you are outside the US or Canada, please choose Not In US/Canada for your state." & "<br>"> </CFIF> <cfset regex_phone_fax = "^[[:digit:]]{3}[-|[:space:]]?[[:digit:]]{3}[-|[:space:]]?[[:digit:]]{4}$"> <!--- Check for phone with valid syntax, when defined ---> <cfif CLIENT.client_country_id is "233" AND isDefined("CLIENT.client_telephone") AND CLIENT.client_telephone is not "" AND NOT REFind( regex_phone_fax, CLIENT.client_telephone)> <cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Your telephone number is not in the correct format" & "<br>"> <cfset regex_email = "^[[:alnum:]_\.\-]+@[[:alnum:]_\.\-]+\.[[:alpha:]]{2,3}$"> <!--- Check for email with valid syntax, when defined ---> <cfif isDefined("CLIENT.client_email") AND CLIENT.client_email is not "" AND NOT REFind( regex_email, CLIENT.client_email)> <cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Your email address is invalid." & "<br>"> <cfset CLIENT.poc_fax = ""> <CFIF Data_Not_Valid> <!--- Redirect to the form ---> <cflocation url="index.cfm/fuseaction/accounts_new_member/invalid_data/yes/reenterdata.htm" ADDTOKEN="No"> http://www.teratech.com