Question

For the ASP.NET validator controls, I want to use both client-side validation for the user experience and server-side validation to guard against hackers. ASP.NET documentation leads me to believe that if EnableClientScript=”True” then there will be no server-side validation if client-side validation is possible for the user agent. To get server-side validation, the documentation says use EnableClientScript=”False”, which bypasses client-side validation altogether.

Am I misunderstanding how the validator controls work? I ask because it seems obvious that many developers would want both client and server side validation together, and I find it hard to believe both together is not possible with one of the standard validation controls.

If I am understanding the ASP.NET documentation correctly, then I can find only two options:

1. Use two validator controls exactly the same except for their ID and EnableClientScript properties. Obviously ugly for maintaining two controls almost the same.

2. Write some code behind to check if postback then invoke the Validate method on the validator group. Why write code behind if there a way to be automatic from the control?

Is there a way to do so using a single validator control with no code behind?

Thanks in advance for your input.

Answer 1

The server-side validation will always occur, so you don’t have to worry about it. The only way around that would be to use the CustomValidator or create your own validator class from BaseValidator that don’t do anything server-side.

By default, server-side validation occurs after Page_Load() and before any triggered events (e.g. button click). In your Page_Load(), however, you can force a Page.Validate(). After validation has occurred you can check the Page.IsValid property.

I recommend you read ASP.NET Validation in Depth. Also, it’s not what you asked for, but it is fundamental that you understand the page lifecycle and ViewState (if you’re not using MVC). Almost everything you will encounter makes use of it.