I have a page which expects a numeric query string value. For example:
Details.aspx?rgn=1234
On this page is an <asp:repeater>
which is databound to an <asp:objectdatasource>
. The datasource looks something like this:
<asp:ObjectDataSource ID="ObjectRegion" runat="server" SelectMethod="GetRegions" TypeName="Region">
<SelectParameters>
<asp:QueryStringParameter Name="RegionID" QueryStringField="rgn" Type="Int32" DefaultValue='0' />
</SelectParameters>
</asp:ObjectDataSource>
Since this is a public page, sometimes I get passed a non-numeric value by hackers / search engines / curious folks. I validate this in my Page_Load. Something like this:
protected void Page_Load(object sender, EventArgs e)
{
int RegionID;
string strRegion = Request.QueryString["rgn"];
if(string.IsNullOrEmpty(strRegion) || !int.TryParse(strRegion, out RegionID))
{
// setup permanent redirect
return;
}
}
The problem is that my repeater still does its databinding anyway which causes a [FormatException: Input string was not in a correct format.]
... which is something I want to prevent. Any ideas of a simple way to get around this?