DT211/3 Internet Application Development JSP: Processing User input

Introduction Directive elements Action elements and JSTL Scripting elements Java Beans So far, have looked at these Will look at how to process user in put from forms using JSP using these techniques

User input Common requirement on the web to process info enter in by user e.g. User enter data onto a form, JSP page is called. JSP page needs to retrieve each piece of data entered. Each piece of data is called a request parameter (because it is passed to the server as part of the HTTP request) Will cover how to retrieve request parameters that user has entered (e.g. on a form)

Request parameters - example Each piece of data is called a request parameter (because it is passed to the server as part of the HTTP request) Please select the Honda 2000 features needed Aero Screen: CD Changer: Spoiler: 2mm Yes Blue

Please select the Honda 2000 features needed Aero Screen: CD Changer: Spoiler: Request parameters - example HTML code for form - 3 request paramters sent to server for processing by “somepage.jsp” Use param implicit object (remember?) to access request parameters (as shown overleaf)

Request parameters - example other head html etc…. Choices selected for your screen, cd changer and spoiler were: Screen: CD changer: Spoiler: Test.jsp Just use “ param.name_of_parameter” to retrieve the value

Request parameters - example Output webpage when test.jsp is run Choices selected for your screen, cd changer and spoiler were: Screen: 2mm CD changer: yes Spoiler: blue

Validing user input Need to be able to validate info entered by user (e.g. “you must enter your name”) Can use JSP to do this Looking at previous example: instead of using a HTML page for the form, use a JSP page so that dynamic validation can be included in it. If user has made an error, need to: --  re-display back the values to the user that they have entered in and display error message(s) see validation_example.jsp overleaf

Please select the Honda 2000 features needed Aero Screen: "> CD Changer: "> Spoiler: "> validation_example.jsp Validing user input - example But no actual validation logic included yet….

Please select the Honda 2000 features needed Aero Screen: CD Changer: Spoiler: 2mm Yes Blue Running validation_example.jsp: input boxes will re- display their contents Validing user input - example

Then, to verify whether user has entered in all input into the validation_example.jsp, need to Add in error message if any input boxes left empty -  Use tag to check contents of each box Only want to check for error messages after the user has pressed submit… need a way to check whether form is being loaded up for first time -  user a hidden form field to detect this… Validing user input - example

Please select the Honda 2000 features needed Aero Screen: "> validation_example.jsp Page 1 of 2 field alreadySent Used to determine whether error processing should take place Value of this request parameter is set to “true” when the form it submitted Validing user input - example

You must enter your choice of screen CD Changer: "> code for CD change validation etc etc Error processing for “screen” parameter validation_example.jsp Page 2 of 2 Validing user input - example

Aero Screen: You must enter your choice of screen CD Changer: Spoiler: Sample output from validation_example.jsp Validing user input - example

Validating user input – comments on example Example illustrated how to: (1) access request parameters (using param... (2) validate user input (by using to test values combined with a hidden flag to see if validation should happen (3) re-display values on a screen (using “value = “<c:out…etc” BUT: what happens when the user correctly entered all the data?.. Need to forward on to another page...

General comments about validation Here… used JSTL actions to do validation. Good for simple validation Multiple ways of doing more complex validation (e.g. value matches a list of valid values in a dB), could:  Use JSTL  Use a java servlet for validation, with JSP displaying back page  Use a java bean (developed by developer)  Use custom tags (built by developer) What about using client side?

General Comments - validation Be careful of server-side vs client-side validation: Client-side can be by passed (e.g. switch off client side scripting).. Security risk Alternative browsers may not process the client side script Generally, any data that will end up in database should be subject to server-side validation –Can be easier to keep validation logic together –No dependancy on browser settings or version –Server side allows for more complex validation. For important info, usually have server side only or serverside and client side For less critical info (e.g. search fields) – could have client side only