input-validation

human's height,weight validation in asp.net

I am trying to make a height (person height) and weight validation. Height should look something like this: 5'11" Anything in any other different format should show up as wrong. What should I use for ValidationExpression? and onee more question "[10-200].(1[0-1]|\d)" is this correct for weight validation ...

ASP.NET MVC 2 RC 2 "Wizard" for whole model validation

There is a good simple solution for a multi-page "Wizard" control in MVC here: http://www.highoncoding.com/Articles/647_Creating_Wizard_Using_ASP_NET_MVC_Part_1.aspx http://www.highoncoding.com/Articles/652_Creating_Wizard_in_ASP_NET_MVC_Part_2.aspx The model is populated in several steps and a hidden field is used to persist data bet...

Determine if a character is alphabetic

Hello, Having problems with this. Let's say I have a parameter composed of a single character and I only want to accept alphabetic characters. How will I determine that the parameter passed is a member of the latin alphabet (a–z)? By the way Im using PHP Kohana 3. Thanks. ...

JSP Validating and Redirecting: how to validate forn input and forward the errors back to the original page?

I'm taking a class on JSP and I have an assignment... we have to write a JSP page that takes user input, validate the input and then forward it to a different web site. To be more precise, we were asked to implement a rudimentary version of the FareFinder functionality of Amtrak's web site. There are 2 main purposes to this assignment:...

Designing Business Objects to indicate constraints such as Max Length

Is there a standard convention when designing business objects for providing consumers with a way to discover constraints such as a property's maximum length? It could be used up in the UI layer to, for example, set a Textbox's MaxLength property according to the maximum length limit back in the business object. Is there a standard ...

Can the same servlet perform input validation from an html form it displayed?

Is it possible to have the same servlet perform validation? It seems that one might have to utilize some sort of recursion here, but when I type in something in the e-mail box and click submit the e-mail parameter is still blank. After I click submit, the URL changes to: http://localhost/servlet/EmailServlet?Email=test The page shows E...

PHP validate input alphanumeric plus a few symbols

Need a way to validate an input field (in PHP) so it can contain only the following: Any letter Any number any of these symbols: - (dash) _ (underscore) @ (at) . (dot) or a SPACE Field can start or end with any of these (but not a space, but I can trim it before passing into validation function), and contain none, one, or any number...

User input filtering - do I need to filter HTML?

Hello all. Note: I take care of SQL injection and output escaping elsewhere - this question is about input filtering only, thanks. I'm in the middle of refactoring my user input filtering functions. Before passing the GET/POST parameter to a type-specific filter with filter_var() I do the following: check the parameter encoding with ...

Validate form fields from InfoPath custom code

I'm developing an InfoPath form for Forms Services. It has these views: View 1 asks the user to input some basic initial data View 2 calls a web service based on data in View 1 and populates drop-downs accordingly At the bottom of View 1 I've added a Next > button to move to View 2. As part of clicking that button I would like the in...

jquery validator plugin field name with special characters

Does anyone know how to get jQuery's validator plugin to recognize input field names with special characters? I have a framework that is generating a form field with these characters: []. Example: <input type="text" name="user[firstname]" id="user-firstname" /> When using Jorn's plugin, the field is disregarded. rules: { user[first...

Safely calling strftime with untrusted format string

We have a C++/MFC application which allows users to customize date formatting via configuration files. Not wanting to reinvent the wheel, I pass the format string to CTime::Format("< format string >") to do the actual formatting. Under the covers, Format calls a variant of the standard C function strftime(). Naturally, the user can ac...

Need advice on how to protect a search/text system from attack

I'm developing a statistically based translation tool to help in haiti, it's a non-profit type thing and free/opensource. (i'm with crisiscommons.) I could really use some advice on how to protect my system from breakage (along with the webspace that i'm paying for out of my own pocket - trust me this is altruism not to make a buck, the...

Add logic to a form when Javascript is disabled

I'd like my form to include a certain value if the quantity is equal to 1 (via a text box). I've managed to show what the total cost is using JavaScript and I could submit it with this value but I'm worried that when JavaScript is turned off the user will be able to submit the form without the extra fee being added. Therefor escaping th...

What are some general best practices for input validation?

What are some best pratices associated with use of IRIs to prevent character missrepresentation, spoofing, or character injection? ...

Validators blocking navigation in asp.net ajax

I am encountering issues in the navigation defined in a master page which are being blocked by validators pages that inherit from the master. How can I disable these validators so that they do not prevent my button actions in the master page? I am using AJAX controls in child pages. ...

What characters to strip from messages?

I'm quite surprised I haven't been able to find out what characters I need to strip from a message in order to keep my application safe. I've got a php app, and most of the inputs are numerical, but I'm adding the ability for users to attache messages, so I need to cleanse the message and strip any characters that could be a threat. ...

PHP filter library or class

I need a filter function for a project I'm working on. I am thinking about using HTML purifier. However I concerned about it performance. Does any of you guys used or using HTML purifier. Or do you suggest another library or class with similar functionality. The most important issues are: utf-8 support xss security ...

Rails Form Validations for Multi-Model Forms

I am trying to build a Rails app with multiple models in a single form, and multiple forms on a single page. To make that work (according to my limited knowledge), I have to drop out of the scaffold code and the "form_for :model" helper and use "form_tag" instead. However when I do that, I lose the ability to automatically catch and repo...

MVC2: Validating User Input / Best Practices

I'm trying to validate user input, in particular user passwords. I have some jQuery validation, but of course I also need to validate on the server side. Now my request comes in to the controller, which will hand it off to a UserService. Everything is loosely coupled, so the controller really doesn't know too much about the inner UserSer...

MS Exam 70-536 - How can you constrain the input before you write any code?

Hello! In MS Exam 70-536 .Net Foundation, Chapter 3 "Searching, Modifying, and Encoding Text" in Case Scenario 1 Your organization, Northwind Traders, is creating a Web-based application to allow customers to enter their own contact information into your database. As a new employee, you are assigned a simple task: create the fro...