Is there any reason I should NOT auto-trim html form parameters?

views:

answers:

+3 Q:

Is there any reason I should NOT auto-trim html form parameters?

Hi,

I just noticed to my surprise that whitespace at the start or end of form parameters is not automatically removed in ASP.NET MVC 2 (browser: Firefox).

I always assumed this would be the case, simply because I could not see a scenario where I would NOT want trimming to happen by default.

This can be fixed very easily by implementing an appropriate ActionFilterAttribute , but I am still wondering why this is not the default.

So, is there any reason I should NOT auto-trim form parameters?

+1 A:

In case the user actually wants the whitespace.
For example, if the user submits some code in the Whitespace programming language.

Can you imagine the outcry if Microsoft would have automatically trimmed all input?

SLaks 2010-07-06 15:32:30

But certainly this is not the norm. Take SO for instance. There not a single field where preserving whitespace makes any sense here. And whitespace could be preserved on some or all parameters as an option. On the other side if I'm not careful to trim all incoming parameters, whitespace will eventually end up in the database, causing all kinds of problems (such as failed logins for newly created login names, passwords, undeliverable e-mail addresses, etc...)

Adrian Grigore 2010-07-06 15:43:59

Nice. I like the Whitespace programming language reference. Very useless. :)

Daniel Dyson 2010-07-06 16:11:06

Exactly my point :-)

Adrian Grigore 2010-07-06 16:27:26

+2 A:

There is no fundamental reason why YOU should not auto-trim YOUR form parameters. After all it is your form. I have lost count of the number of times I have found unnecessary white space in database entries, especially at the start of entries. It really plays havoc with searching, so I think it is good practice to always do it.

Also, I agree with SLaks. People would be crying blue murder if MS had taken upon itself to do it automatically. There would be posts like "Why is my whitespace automatically trimmed?"

Edit: If you wanted to do this trimming early in the ASP.NET pipeline, use an HTTPModule. This way you won't ever have to think about it again, until you find yourself thinking "Where has the whitespace gone?" :)

Daniel Dyson 2010-07-06 16:01:09

Well, now there is a post like "why isn't my whitespace trimmed" :-). My point is that the default almost always is what the vast majority of developers use. And if it's not the default, then MS usually makes it easy to make the necessary changes (as opposed to rolling your own solution like in this case).

Adrian Grigore 2010-07-06 16:46:43

Yes, I agree with you on this. There should probably be a config setting that specifies whether Trim() should be called on QueryStrings and Form data prior to it being made available. But then, that is what HttpModules are there for: to intercept requests and mess with them.

Daniel Dyson 2010-07-06 16:56:15

Thanks for the link to the blog. I've already used the workaround listed at http://stackoverflow.com/questions/1718501/asp-net-mvc-best-way-to-trim-strings-after-data-entry-should-i-create-a-custom, but a http module seems like a more robust solution as it also covers action methods without strongly typed input.

Adrian Grigore 2010-07-06 22:38:04

ansaurus

tags:

views:

answers:

Is there any reason I should NOT auto-trim html form parameters?

related questions