Question

I know to never trust user input, since undesirable input could be compromise the application’s integrity in some way, be it accidental or intentional; however, is there a case for calling Page.IsValid even when no validation controls are on the page (again, I know its bad practice to be trusting user input by omitting validation)? Does Page.IsValid perform any other kinds of validation? I looked at MSDN, and the docs seem to suggest that Page.IsValid is only effective if there are validation controls on the page, or the Page.Validate method has been called. A friend of mine suggested that I always check Page.IsValid in the button click handlers every time even if there are no validation controls or explicit Page.Validate calls.

Answer 1

I would be the first to tell you that “All input is evil until proven otherwise.” However, in this case, I think your friend is mistaken because by his/her logic we could probably come up with a hundred other properties that should be checked or set, even though the defaults are okay.

Checking Page.IsValid only makes sense if you have a “CausesValidation” scenario – a button that submitted the form has its CausesValidation property set to True. This would automatically call Page.Validate and all Validation controls belonging to the same ValidationGroup would be checked for validity.

Edit:

Just checked it using Reflector and the function will always return True if the Page does not have any Validators(ValidatorCollection is null).