How reliable is the MaxLength property of the TextBox-Control?

views:

238

answers:

+3 Q:

How reliable is the MaxLength property of the TextBox-Control?

The TextBox control offers a MaxLength property, which allows the insertable text into that TextBox be clientside limited to the specified amount of chars.

My questions:

Is this property only client-side and therefore browser-pedendent?
Can I rely on the fact, that the Text property contains no text longer than MaxLength is set (only for the DisplayModes named in the MSDN article) or do I manually have to perform a TextBox.Text.SubString(0, DesiredMaxLength) ?
How does all this behave with disabled java-script?

+6 A:

It does not depend on javascript but that does not make it safe.

Anyone can still post a request using javascript (XmlHttpRequest for example) or just craft a request to send more data than the max-length specification. It's a good way to stop a normal user from over populating a field but it is something you need to double check on the server anyway.

Locksfree 2010-03-10 10:59:17

Meaning the TextBox-Control does not server-side security to limit the MaxLength Property? If I understand you correctly, you are telling me, that with "normal" usage from within my webapp I can rely that a normal user can't bypass the specified maxlength?

citronas 2010-03-10 11:04:58

The text box will not check on the server side AFAIK. And I am saying that for a normal user not trying to do anything wrong it would work but that it not safe to rely on it.

Locksfree 2010-03-10 11:43:20

I was pretty disturbed how easily one could get around the MaxLength limitation if they really wanted to. The way I went around fixing this(instead of attaching a million validators) was to extend the TextBox class and override the Text Property. In the getter, if the MaxLength value is greater than 0, I trim the value to the MaxLength value.

rossisdead 2010-07-23 18:38:27

+2 A:

Can I rely on the fact, that the Text property contains no text longer than MaxLength ?

No. Consider it a user-friendliness feature. You will have(as always) re-check on the server. And maybe also check in JavaScript, depending on what its for.

Henk Holterman 2010-03-10 11:03:12

ansaurus

tags:

views:

answers:

How reliable is the MaxLength property of the TextBox-Control?

related questions