Question

I have an existing project, so I need a solid way of cleaning/checking user input, globally.

I have a Master page (parent) that has the form tag, and the “children” pages contains the form elements with the post back commands, insert/update/delete to database etc.

Using C# only – Is there some way I can globally intercept the postbacks before post runs through the child page?

And is it possible to check if it’s a textbox/checkbox/radioButton etc. to manipulate cleaning of user input differently?

Answer 1

This is what I did to get it working.

• Override the OnInit event on my MasterPage

• Disable the ReadOnly for my Request collection so it is settable.

• Loop through Posted .Net Controls, Sanitize value and set new value.

• Re-enable ReadOnly.

Works great globally and saved me days of manual labour 🙂

protected override void OnInit(EventArgs e)
    {
        base.OnInit(e);

        if (IsPostBack)
        {
            var fCollection = (NameValueCollection)Request.GetType().GetField("_form", BindingFlags.NonPublic | BindingFlags.Instance).GetValue(Request);
            PropertyInfo oReadable = fCollection.GetType().GetProperty("IsReadOnly", BindingFlags.NonPublic | BindingFlags.Instance);
            oReadable.SetValue(fCollection, false, null);

            foreach (string s in Request.Params.Keys)
            {
                var pCtrl = Page.FindControl(s);

                //Sanitize the posted values (TextHandler.SimpleSanitize is my own static method)
                if (pCtrl != null) fCollection[s] = TextHandler.SimpleSanitize(fCollection[s]);
            }

            oReadable.SetValue(fCollection, true, null);

        }
    }