Form Validation Techniques: Don Edlin, MRSC

Form Validation
Techniques
Don Edlin, MRSC

[email protected]
1
Why Validate?
 Usability
 Frustrating for the user
 Data Integrity
 Ensure your getting data in the format you expect
 Security
 Keeping your forms from being used against you or your users
 Assume all input is evil
2
SQL Injection Attacks
 Not limited to SQL Server – Oracle, MySQL, DB2, Sybase, etc.

 It’s suggested that you take a layered approach to preventing these
attacks.
 Can be executed in form fields and in querystrings.
 First layer of protection:
Principle Implementation
Never trust user input Validate all textbox entries using validation
controls, regular expressions, code, and so on
3
Cross Site Scripting Attack
 Cross-site scripting allows hackers to run malicious script

in a client’s Web browser
 Any Web page that renders dynamic HTML based on
content that users submit is vulnerable
 That script can then be executed by the browser of an
unsuspecting user. The browser has know way of
knowing that the script shouldn’t be executed.
4
Approaches to Form Validation
 Disallow incorrect input

 You have to know what to disallow
 May be other ways to represent certain characters.
 Allow a small number of required input characters
 Requires more code, but allows for much tighter code
 (Either way or both ways - limit entry length)
 Many injection attacks require a large number of characters
5
Where to Validate
 Server Side
 CGI, ASP, .Net, Coldfusion, etc.
 Pros
 Ensures that every time the form is submitted, the validation will
run.
 Allows for validation against other server resources, such as a
backend database and business rules.
 Cons
 Puts more load on the server.
 Slower
6
Where to Validate
 Client Side
 JavaScript
 Pros
 Processing is done on the client computer

 Faster
 Cons
 Will not work if the user has it disabled
 Not a solution for security.
 Not a good solution for data integrity.
7
The Answer
 Most likely you will want a combination of client side and server side
validation.*
 Consider JavaScript validation as adding usability, not providing security.
 Never use client side validation for security.
 Do include a maximum length on your input tags.
 Encode input from users and querystrings.
*Some validation will run on both the client and on the server.
.Net validation controls for example
8
When Server Side is also Client Side
 Many server side controls will produce JavaScript for validation
when the page is served.
 Asp.net form field with validation
<form runat="server">
Email:<asp:textbox id="txtEmail" size="20" runat="server"/><br>
<ASP:RequiredFieldValidator ControlToValidate="txtEmail" Display="Static"
ErrorMessage="*Email is a required field."
runat="server" />
 Resulting form on Page

<form name="_ctl0" method="post" action="name_email1.aspx"
language="javascript" onsubmit="ValidatorOnSubmit();" id="_ctl0">
<script language="javascript" type="text/javascript"
src="/aspnet_client/system_web/1_0_3705_6018/WebUIValidation.js"></
script>
9
JavaScript for Usability
 What can you do with JavaScript?

 Check required fields
 Compare one input value against another.
 Set a field based on user input.
 Check substrings entered by the user.
 Combine with Regular Expressions to perform more
detailed string matching validation
10
JavaScript Zip Code Example
function validateZIP(field) {
var valid = "0123456789-";
var hyphencount = 0;
if (field.length!=5 && field.length!=10) {

alert("Please enter your 5 digit or 5 digit+4 zip code.");
return false;
}
for (var i=0; i < field.length; i++) {
temp = "" + field.substring(i, i+1);
if (temp == "-") hyphencount++;
if (valid.indexOf(temp) == "-1") {
alert("Invalid characters in your zip code. Please try again.");
return false;
}
if ((hyphencount > 1) || ((field.length==10) && ""+field.charAt(5)!="-")) {
alert("The hyphen character should be used with a properly formatted 5 digit+four zip code, like
'12345-6789'. Please try again.");
return false;
}
}
return true;
}
11
Regular Expressions
 A powerful tool used in pattern-matching and substitution

 Included in JavaScript 1.2
12
Some of The Special Characters
 Always begin and end with a slash.

/regular expression is in here/
 \ Toggles between literal and special characters.
 $ - end of a string. \$ - ignore the special character and use the
$.
 w – literal character. \w – matches any letter, number, or the
underscore
13
Example
 Validate a zip code.

 Want to allow for 5 or 10 digit zip code.
 Make sure the “–” is in the correct position.
 Don’t allow a “–” for 5 digit zip.
14
Regular Expression Code
re = /(^\d{5}$)|(^\d{5}-\d{4}$)/
function validateZIP(field) {
if (re.test(field)) {
return true
}
alert("Invalid Zip Code")
return false }
15
Regular Expression Code
/(^\d{5}$)|(^\d{5}-\d{4}$)/
/ - start and end of regular expression
() - used for grouping
\d – matches any digit 0 through 9
{5} – at least 5 occurrences of the previous character
$ - end of string
| - alternation - or
16
Conclusion
 Provide JavaScript client side validation for the primary

purpose of usability and formatting.
 Perform server side validation for security purposes.
 Regular expressions can be used on client and server
side to validate data and reduce coding.
 Test client side scripting, then turn off active scripting in
your browser and test again.
17
Resources
Security
 http://www.owasp.org/index.jsp
 http://www.cgisecurity.com/articles/xss-faq.shtml#whatis
 http://www.technicalinfo.net/papers/CSS.html
 http://msdn.microsoft.com/msdnmag/issues/04/09/SQLInjection/default.aspx
JavaScript and Regular Expressions

 http://javascript.internet.com/forms/
 http://www.webdevtips.com/webdevtips/js/validform/index.shtml
 http://www.webreference.com/js/column5/
 http://javascriptkit.com/javatutors/re.shtml
18

Form Validation Techniques: Don Edlin, MRSC

Uploaded by

Copyright:

Available Formats

Form Validation Techniques: Don Edlin, MRSC

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Form Validation Techniques: Don Edlin, MRSC

Uploaded by

Copyright:

Available Formats

Form Validation

Don Edlin, MRSC

 Not limited to SQL Server – Oracle, MySQL, DB2, Sybase, etc.

 Cross-site scripting allows hackers to run malicious script

 Disallow incorrect input

 Processing is done on the client computer

 Resulting form on Page

 What can you do with JavaScript?

if (field.length!=5 && field.length!=10) {

 A powerful tool used in pattern-matching and substitution

 Always begin and end with a slash.

 Validate a zip code.

 Provide JavaScript client side validation for the primary

JavaScript and Regular Expressions

You might also like