1. ColdFusion Form Handling Michael Smith, President TeraTech, Inc
ColdFusion, Database & VB custom development

2. Introduction Michael Smith President TeraTech Run MDCFUG
CFUN-2k, CF2001
CF programmer and teacher
Articles in CFDJ, CFAdvisor, Fusion Authority

3. Why are Forms important?
Valid data!
Make site easy to use – or not!
Layout indicates required fields
Section 508 compliant
Security – eg SQL add in, fake form submits and URL

4. Form basics <FORM METHOD ACTION Submits via header or URL
CF creates Form scope
Structure
Action to other form, self, , JavaScript
Other elements can submit via JavaScript – or auto self submit on timer!

5. Validation Data type In range Text length Lookup lists
Radio button or check box
Credit card
Field by field vs form wide validation

6. CFFORM CFINPUT CFSELECT CFTEXTINPUT CFSLIDER CFGRID CFTREE
Onvalidate and and onerror extensions

7. CFFORM pros and cons Creates JavaScript validation code
Immediate feedback
No refocus after error
CF 5 big download
Phone validation a bit strong
Dreamweaver form elements
Not 508 compliant

8. _ field validation Hidden form fields
_date, _required, _eurodate, _float, _integer, _range, _time
<INPUT TYPE=“hidden” NAME=“mydatafield_required” VALUE=“Message”
Works even if javascript turned off
Can not use names with _date in them!
Fake submit security bypass!
Doesn’t work with GET

9. JavaScript validations
Onsubmit function
Totally custom – eg multiple fields
Harder to write and maintain
Security issue
Save server load
Not 508 compliant
Browser version dependent

10. Submit page validations
Most secure
Most flexible
More complex CFIF
Table look ups
Clean up data with val() and CFQUERYPARAM
CGI.HTTP_REFERER

11. Traps Check data type CFQUERY WHERE variables
CFINPUT and CFUPDATE – beware
Check boxes don’t exist
Wacky characters like ‘
Submit page run directly
File upload – must use multipart form
<input type="File“ name=“file”>
ENCTYPE”multipart/form-data”

12. Where to submit to Method POST vs GET (default!) Myform_sub.cfm
Self – use action = #CGI.SCRIPT_NAME#?#CGI.QUERY_STRING#
Hidden fields for arguments
Redisplay entered info plus error message
Size issue with Get, much bigger with POST (text area may fill it!)

13. Fusebox submit to index.cfm with fuse that: fusebox CF_REUSEFORM
validates the data.
If valid
Insert SQL
Else
CFLOCATION to form with data filled out
fusebox CF_REUSEFORM

14. Credit card issues Don’t resubmit Review field page before processing
Insert data before sending to credit card site in case of failure.

15. References
Ben Forta “Web Application Construction Kit” Chap 12, 14, 15, 23
Kristin Motlagh “Mastering CF” Chap 14, 15
Builder.com form validation basics

16. Questions? Ask now… MDCFUG-L list … or email michael@teratech.com

17. Sample code to cut and paste
<!---
|| BEGIN FUSEDOC ||
|| Properties ||
Name: act_validate_new_account_data.cfm
Author:
|| Responsibilities ||
I define the application wide parameters for the site.
|| Attributes ||
|| END FUSEDOC ||--->
|| General ||
Name:
Author: Martin Cadirola
Copyright (c) 2000, All rights reserved
|| History ||
|| Purpose ||
This fuse is target of in_SubmitJob and err_SubmitJob.
First thing is to convert all form fields to session variables, then work from there...
Data that is not valid gets cleared so that err_SubmitJob shows erroneous data blank
* roleID , a string. single value
* position_types , a comma separated list
* locations , a comma separated list
* title
* company_website
* salaryrange_low
* salaryrange_high
* poc_phone
* poc_fax
* poc_
* astd_firstname
* astd_lastname
* astd_company
* astd_phone
* astd_
<!--- CONVERT ALL FORM VARIABLES INTO SESSION VARIABLES --->
<cf_FormFields2SessionVars>
<!--- INITIALIZE VALIDATION VARIABLES: FLAG AND MSG --->
<cfset Data_Not_Valid = "False">
<cfset CLIENT.msgErrorCreateEditAccount = "" >
<!--- If this user is a doctor, make sure the required fields are there
For doctors, we need:
DEA#
SPECIALTY
STATE
--->
<cfif isDefined("attributes.isdoctor") and attributes.isdoctor is "on">
<cfif attributes.client_DEA_number lt 5>
<cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Please enter your DEA ##" & "<br>">
<cfset Data_Not_Valid = "True">
</cfif>
<cfif Data_not_valid>
<cfset CLIENT.msgErrorCreateEditAccount =
"For doctors, we ask that you please fill out the following fields:<br>
  * DEA##<br>
  * <br>
  * SPECIALTY<br>
  * STATE<br>
#CLIENT.msgErrorCreateEditAccount#">
<!--- CHECK FOR TITLE --->
<!--- <cfif CLIENT.client_first_name is "">
<cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "First Name" & "<br>">
</cfif> --->
<cfif CLIENT.client_last_name is "">
<cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Last Name" & "<br>">
<!--- <cfif CLIENT.client_address1 is "">
<cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Address" & "<br>">
<!--- <cfif CLIENT.client_city is "">
<cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "City" & "<br>">
<!--- <cfif CLIENT.client_postal_code is "">
<cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Postal Code" & "<br>">
<cfif CLIENT.client_password is "" OR CLIENT.client_password_check is "" or CLIENT.client_password is NOT CLIENT.client_password_check>
<cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Unable to validate passwords" & "<br>">
<cfif CLIENT.client_country_id is "233" and CLIENT.client_state_id is 1>
<cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Please select your state" & "<br>">
<cfif CLIENT.client_country_id is "39" and CLIENT.client_state_id is 1>
<cfif CLIENT.client_state_id is not 1>
<CFIF CLIENT.client_country_id is not "39" AND CLIENT.client_country_id is not "233">
<cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "If you are outside the US or Canada, please choose Not In US/Canada for your state." & "<br>">
</CFIF>
<cfset regex_phone_fax = "^[[:digit:]]{3}[-|[:space:]]?[[:digit:]]{3}[-|[:space:]]?[[:digit:]]{4}$">
<!--- Check for phone with valid syntax, when defined --->
<cfif CLIENT.client_country_id is "233" AND isDefined("CLIENT.client_telephone") AND CLIENT.client_telephone is not "" AND NOT REFind( regex_phone_fax, CLIENT.client_telephone)>
<cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Your telephone number is not in the correct format" & "<br>">
<cfset regex_ =
<!--- Check for with valid syntax, when defined --->
<cfif isDefined("CLIENT.client_ ") AND CLIENT.client_ is not "" AND NOT REFind( regex_ , CLIENT.client_ )>
<cfset CLIENT.msgErrorCreateEditAccount = CLIENT.msgErrorCreateEditAccount & "Your address is invalid." & "<br>">
<cfset CLIENT.poc_fax = "">
<CFIF Data_Not_Valid>
<!--- Redirect to the form --->
<cflocation url="index.cfm/fuseaction/accounts_new_member/invalid_data/yes/reenterdata.htm" ADDTOKEN="No">