Question

I’m building a publicly available web app. Because of this, I’ll be validating every field as exhaustively as I can. I mean, if someone enters something that isn’t valid, they will know exactly what it was (making it clear what they need to fix).

I’ve followed Scott Guthrie’s examples in the NerdDinner eBook. I love the idea of having all my validation in the core class files (as a partial class).

The validation I’m performing is this:

• Min value – make sure strings are at least a certain length
• Max value – make sure strings are under a maximum length (based on field properties in the DB)
• int checks – make sure integer fields can be correctly parsed to int
• file extension – make sure the uploaded file extensions are of the correct type

My question is, what are the typical validation checks you make in your web apps? Maybe I’m completely overlooking something. 😉

Thanks in advance!

Answer 1

You should try to use existing frameworks as much as possible for validation. Writing a comprehensive validation library is a lot of hard and time-consuming work. It’s one of those things that are best left to a team of people dedicated to developing it such as the jQuery validation plugins and projects like that. There are a lot of really nice validator libraries out there already that could save you a lot of time and effort.

There is an MVC validator toolkit project on codeplex you may find helpful. CodeProject has a tutorial on it if you want to read more into it. You can also check out xVal, as one of the commenters mentioned.

If you have a specific reason you need to write validation in-house, or you aren’t convinced by what I said above, a few that I find useful are:

• Required field validation, obviously. You might already have this by just checking for minimum length in your fields.
• Generic regular expression validation. Make sure you have some way to perform this kind of validation generically. This will help you in case there is some specific field that needs a unique form of validation found no where else in your site. Make sure your API is flexible enough to add specific regular expression based validation.
• Email. You’ll need this.
• Phone numbers. These can be tough because of all the forms they can come in (all numeric, sometimes with alpha characters, sometimes international numbers that follow different formats)
• Dates & times are important also, however you should consider using some sort of date/time picker to reduce the possibility of error by not allowing the user to type a value.
• Make sure you include validation capabilities for non-textbox related fields, such as drop-down lists, radio buttons, check boxes, etc. I’ve forgotten these in the past just out of oversight, but they do become important.
• Matching fields. For example, when confirming a password, both fields should match. This won’t be used in just one page. Think about password resets, administrative pages, user control panels, etc.
• Although somewhat complex, you might also want to include sequence validation. For example, perhaps some options on your site require you to select other options first. Another example is that certain options should only be selectable if you first choose some other combination of options. This is something that you may not be able to include in a generic API, but it’s something to think about.