Question

I have a page which expects a numeric query string value. For example:

Details.aspx?rgn=1234

On this page is an <asp:repeater> which is databound to an <asp:objectdatasource>. The datasource looks something like this:

<asp:ObjectDataSource ID="ObjectRegion" runat="server" SelectMethod="GetRegions" TypeName="Region">
  <SelectParameters>
    <asp:QueryStringParameter Name="RegionID" QueryStringField="rgn" Type="Int32" DefaultValue='0' />
  </SelectParameters>
</asp:ObjectDataSource>

Since this is a public page, sometimes I get passed a non-numeric value by hackers / search engines / curious folks. I validate this in my Page_Load. Something like this:

protected void Page_Load(object sender, EventArgs e)
{
    int RegionID;
    string strRegion = Request.QueryString["rgn"];
    if(string.IsNullOrEmpty(strRegion) || !int.TryParse(strRegion, out RegionID))
    {
        // setup permanent redirect
        return;
    }
}

The problem is that my repeater still does its databinding anyway which causes a [FormatException: Input string was not in a correct format.]… which is something I want to prevent. Any ideas of a simple way to get around this?

Answer 1

I answered my own question. I forgot to add a Response.End() on the permanent redirect:

Response.Status = "301 Moved Permanently";
Response.AddHeader("Location",URL);
Response.End();