Question

So, I’ve been trying to clean up my code and learn things that I should always do…well of course server-side validation is one of those things that I should always do. However, what happens when I have this huge form? I really would like to have a generic function that allows me to pass the data type and field name. Is there a secure way to do this in Coldfusion?

I’ve been looking into doing this for a while, but I’ve come to dead ends and can’t find any info on doing something like this on the web. It seems like Coldfusion does not offer this ability.

However, I think it would be cool if there was a way to specify an attribute in your input tags that had the data type of the field. Then, it would be uber nice if Coldfusion stuck it into a struct for you with your field names.

Is there anyway to accomplish this or can someone elaborate on the most efficient way to do server-side validation?

Answer 1

That would be great if CF had something like that! Good news, it does, for years now! 🙂

What you’re looking for is cfinput (and cfform) tag. This tag includes the validation specifics right in the tag like you’re wanting (great minds think alike, right?). You can specify the validation, the error message, if it should validate client or server side – all kinds of neat tricks.

Check here for implementation – it’s quite easy to use:

http://livedocs.adobe.com/coldfusion/8/htmldocs/help.html?content=Tags_i_07.html

Be warned that a lot of code diva’s hate cfform / cfinput. In reality, there is nothing wrong with them when implemented correctly. It can be abused and it won’t fit for every solution, but that is true of everything in the toolbox. By and large, for most form input and validation situations it works great.

If you hate that idea, another is to use the built in type attribute of cfparam and catch your errors.

For example, at the top of your form processing page, you can :

<cfparam name="form.cardNumber" type="creditcard">

When this is reached, if the value in that variable is not of that type, it will throw an exception that you can catch. This keeps you from having to write the if() and pattern matching. Additionally, if there isn’t a type built in, you can specify a regular expression for pattern matching.

Here’s some more information and the types supported:
http://livedocs.adobe.com/coldfusion/8/htmldocs/help.html?content=Tags_p-q_01.html

Let me know what you think!