Does disabling a .NET control prevent it from posting back

Question

I have a custom made ASP control which is based on a select (drop down menu). If I disable my control by adding the word "disabled" in its html, I start getting null pointer errors when processing the form data.

I figure, either the browser doesn't post back disabled form items or ASP.NET ignores them when processing the form data. I'm not sure which one it is. I'm trying to understand where I'm loosing data.

Thanks for your help.

PS. I realize that there are better way to create and disable controls than manually editing html but there's a context here that doesn't allow me to do otherwise.

Answer 1

Yes setting control's Enable = false is prevents control's value to be added posted data collection.

you can use readonly attribute instead.

here in MSDN it says :

The Text value of a TextBox control with the ReadOnly property set to true is sent to the server when a postback occurs, but the server does no processing for a read-only text box. This prevents a malicious user from changing a Text value that is read-only. The value of the Text property is preserved in the view state between postbacks unless modified by server-side code.

Also here is the Microsoft's reply to a bug report related to topic.

but if you use in classical way like that it will work :

txt2.Attributes.Add("readonly", "readonly");

Answer 2

It will prevent the control from posting back but remember this web paradigm is a client/server technology. A person could modify the client data (HTML and / or Javascript) and force a postback no matter what you send him.

Therefore don't rely on this for security sensitive operations such as money manipulation and so on.

Always do a check on the server-side too for sensitive operations.