I have a page which receives user submitted variables, 1 or 2 of which have to be integers. These integers have to be in the range 1 to 64,000 (64,000 is arbitrary, maybe I should use the max range for Clng, 2147483647...)

I have a very longwinded way to check this.

if len(request("mid")) > 5 or len(request("rid")) > 5 then response.redirect ("x.asp")
(...prevent overflow error caused by user entering too many chars)

if not isNumeric(request("mid")) or not isNumeric(request("rid")) then response.redirect ("x.asp")

if cLng(request("mid")) > 64000 or cLng(request("mid")) < 1 then response.redirect ("x.asp")

if cLng(request("rid")) > 64000 or cLng(request("rid")) < 1 then response.redirect ("x.asp")

This seems very inefficient, can somebody show me the true way!?

Regards, Guy

Hi,

 Better you do these validations at client side instead of server side.



------------
Rajani

To check a value is a number and > 64000 in Javascript (yes better to do it on the client side) put this in the head of your document inside script tags:

function validate()
{
  if(isNaN(parseInt(document.fName.fieldName.value))
  {
     alert("You must enter a valid number");
     document.fName.fieldName.focus();
     document.fName.fieldName.select();
     return(false);
     if(document.fName.fieldName.value < 64000)
     {
        alert("Num should be less than 64000");
        document.fName.fieldName.focus();
        document.fName.fieldName.select();
        return(false);
     }
  }
  return (true);
}

now put this inside your <form> tag:
onSubmit="return validate();"

Wind is your friend
Matt

Looks like this needed some fine tuning.
Hope that helps.
Cheers!

_________________________
- Vijay G
Strive for Perfection

Hi all,

Thanks for your suggestions/solutions.

I still need to do server side validation as it is possible for uesrs to sneak their way around javascript validation, and I would like my site to be watertight.

Is there a good way of trapping all errors (including those I cant foresee!) and redirecting the user to a specified page.

That way if someone does manage to 'crash' a page they wont get any generic error messages.

Thanks in advance, Guy

Then check for IsNumeric IsNAN vbscript functions and can use the same logic as the javascript code that was posted.

_________________________
- Vijay G
Strive for Perfection

;;;sneak their way around javascript

How is this done? I do realize Javascript can be disabled, this doesnt allow a user to sneak around though. If the page the form is posting to checks an expected form variable has been posted it can:
a..let them in
or
b..redirect then back until it's submitted as the developer intended

Wind is your friend
Matt

The simplest way is just to not use your page with the js validation to post the data. For any HTML page I can view the source, see what your fields are called, see where the form posts to and then construct my own HTML page with the same field names and post target - then voila I can post anything I like to your destination page. How will your js stop that?

Guy is correct, you should always repeat validation at the server-side. The golden rule is "never trust anything that comes via the browser"

Guy, look into providing custom 500;100 error pages, assuming you're using IIS5+. See http://support.microsoft.com/?kbid=299981 and http://support.microsoft.com/?kbid=224070 for examples.

hth
Phil

Thanks all,

and cheers to PGTips!

Guy