Earlier in this chapter, in Section 5.1.1, we discussed the three common steps taken to create a form:

At that time, I mentioned we would look at ways to create robust, reusable code for Steps 1 and 3. Since server-side form validation is paramount to client-side form validation, it makes sense to start by creating code for Step 1. In this section, we will look at how to create a single, reusable ASP page that uses regular expressions to validate form data. In Section 5.5, the discussion will switch to creating a class interface to aid in accomplishing Step 1.

Our reusable server-side form validation routine will exist on the /CODEREUSE/ValidateForm.asp ASP page. (That means every form on our web site will have its ACTION property set to /CODEREUSE/ValidateForm.asp.) This page will contain code that will iterate through the proper collection of the Request object, reading in the value of each form field and determining whether or not the value is valid.

Our validation page, /CODEREUSE/ValidateForm.asp, needs to know what constitutes a valid entry for each and every form field. We’ll supply this information in the NAME property of the form field. Since regular expressions are used to validate form field input, each form field that needs to be validated will contain the proper regular expression appended to the NAME property. For example, if we had a form field for the user to enter his telephone number, we would use the following HTML to create the text box:

<FORM METHOD="POST" ACTION="/CODEREUSE/ValidateForm.asp">
    <INPUT TYPE="HIDDEN" NAME="Collection" VALUE="Form">
    <INPUT TYPE="HIDDEN" NAME="Redirect" VALUE="/SomePage.asp">

    <!-- This will be validated, since the element name contains an
         exclamation point followed by the needed regular expression. -->
    Enter your phone number in the following format: ###-###-####<BR>
    <INPUT TYPE="TEXT" NAME="Phone Number!^d{3}-d{3}-d{4}$">
    <P>
    <!-- This form field will NOT be subjected to any validated tests
         since it does not contain the exclamation point in its name. -->
    Enter your first name:<BR>
    <INPUT TYPE="TEXT" NAME="First Name">
    <P>
    <INPUT TYPE="SUBMIT" VALUE="Submit!">
</FORM>

Note that an exclamation point separates the English-like name of the form field (txtPhone) and the regular expression (d{3}-d{3}-d{4}). The regular expression will be used to validate the user’s input in /CODEREUSE/ValidateForm.asp. Also note that the form’s ACTION property directs the submitted form to /CODEREUSE/ValidateForm.asp.

The above form also contains two HIDDEN form fields. The first HIDDEN form field, Collection, specifies what Request object collection to use. The Value for this HIDDEN form field would have been QueryString, had the form’s METHOD been set to GET. The second HIDDEN form field, Redirect, specifies the ASP page that is responsible for processing the form data. This page (via a Server.Transfer) is called only if the submitted form data is valid.

The code for /CODEREUSE/ValidateForm.asp will perform the following steps:

Quite a tall order for /CODEREUSE/ValidateForm.asp ! Here is the code, with the regular expression validation emphasized:

<%@ LANGUAGE = "VBSCRIPT" %>
<% Option Explicit %>
<%
    Function EnglishName(str)
      'Check to see if there is an exclamation point: if so, hack off
      'all contents of the string to the right of the exclamation point
      If InStr(1,str,"!") > 0 then
        EnglishName = Left(str,InStr(1,str,"!") - 1)
      End If
    End Function


    'Determine what collection to use
    Dim strCollection
    strCollection = Request("Collection")

    'Create a reference to the property Request collection
    Dim colRequestCol
    If Ucase(strCollection) = "QUERYSTRING" then
      Set colRequestCol = Request.QueryString
    Else
      Set colRequestCol = Request.Form
    End If


    Dim strItem, strErrors, objRegExp, strErrorLog
    Set objRegExp = New regexp    ' Create a regexp instance
    objRegExp.IgnoreCase = True
    objRegExp.Global = True

    'Iterate through each of the form field elements
    For Each strItem in colRequestCol
      'See if there is an exclamation point.  If there is,
      'then we need to perform form validation
      If InStr(1,strItem,"!") > 0 then
        'Grab the regular expression pattern
        objRegExp.Pattern = Mid(strItem, InStr(1,strItem,"!") + 1, Len(strItem))
        If Not objRegExp.Test(colRequestCol(strItem)) then
          'Input invalid!  Append to the error log
          strErrorLog = strErrorLog & "<BR>Invalid Input for " & _
                        EnglishName(strItem)
        End If
      End If
    Next

    'Are there any errors?
    If Len(strErrorLog) > 0 then
       Response.Write "<B>The following validation errors occurred:</B>"
       Response.Write strErrorLog
    Else
       'No form validation errors occurred!
       'Use Server.Transfer to send the user to the proper 
       'form validation script
       'If the user didn't specify a redirect, raise an error
       If Len(Request("Redirect")) = 0 then
          Raise vbObjectError + 1010, "Validation Error", "Redirect not specified"
       Else
          Server.Transfer Request("Redirect")
       End If
    End If

    Set colRequestCol = Nothing    ' Clean up
    Set objRegExp = Nothing
%>

Keep in mind that /CODEREUSE/ValidateForm.asp serves only one purpose—to perform server-side validation. If there are no validation errors, the script transfers control to the form-processing page specified by the HIDDEN form field Redirect. Due to the fact that /CODEREUSE/ValidateForm.asp only performs server-side validation and transfers the user to the correct form-processing script, all of our HTML pages can call this single validation page. This means once this system is implemented, when creating a form, you will not have to code its server-side validation! Figure 5.1 further illustrates the page flow that occurs when a form is submitted.

Figure 5-1. /CODEREUSE/ValidateForm.asp validates all forms on the site

Now, let’s look at how to encapsulate the logic in /CODEREUSE/ValidateForm.asp through the use of classes!

<%
   Class FormData
     '****************** PROPERTIES ********************
     Private colRequestCol
     Private objRegExp
     Private objErrorDict
     '**************************************************


     '************** INITIALIZE/TERMINATE **************
     Private Sub Class_Initialize(  )
        'Determine what Request collection to use
        If Ucase(Request("Collection")) = "QUERYSTRING" then
          Set colRequestCol = Request.QueryString
        Else
          Set colRequestCol = Request.Form
        End If

        'Instantiate a regexp object
        Set objRegExp = New regexp
        objRegExp.IgnoreCase = True
        objRegExp.Global = True

        'Instantiate the error log
        Set objErrorDict = CreateObject("Scripting.Dictionary")
     End Sub

     Private Sub Class_Terminate(  )
        Set colRequestCol = Nothing
        Set objRegExp = Nothing
        Set objErrorDict = Nothing
     End Sub
     '**************************************************


     '************* PROPERTY GET STATMENT **************
     Public Property Get ErrorLog(  )
       'Return the Error Log Dictionary Object
       Set ErrorLog = objErrorDict
     End Property
     '**************************************************


     '********************* METHODS ********************
     Public Function ValidInputs(  )
       'Checks to see if data is valid.  If it is, returns
       'True, else returns False.  A list of errors can be
       'obtained through PrintErrors

       Dim strItem

       'Iterate through each of the form field elements
       For Each strItem in colRequestCol
         'See if there is an exclamation point.  If there is,
         'then we need to perform form validation
         If InStr(1,strItem,"!") > 0 then
           'Grab the regular expression pattern
           objRegExp.Pattern = Mid(strItem, InStr(1,strItem,"!") + 1, _
                               Len(strItem))
           If Not objRegExp.Test(colRequestCol(strItem)) then
             'Input invalid!  Append to the error log
             objErrorDict.Add EnglishName(strItem), _
                              colRequestCol(strItem).Item
           End If
         End If
       Next

       'Did we encounter any errors?
       If objErrorDict.Count > 0 then
         ValidInputs = False
       Else
         ValidInputs = True
       End If
     End Function


     Private Function EnglishName(ByVal str)
       'Check to see if there is an exclamation point: if so, hack off
       'all contents of the string to the right of the exclamation point
       If InStr(1,str,"!") > 0 then
         str = Left(str,InStr(1,str,"!") - 1)
       End If

       EnglishName = Replace(str, "_", " ")
     End Function


     Public Function ErrorMessage(  )
       'Returns a string containing an error message
       If objErrorDict.Count = 0 then
          ErrorMessage = "There were no validation errors."
       Else
          Dim strName
          For Each strName in objErrorDict
            ErrorMessage = ErrorMessage & "Error in " & strName & _
                " - the entry " & objErrorDict(strName) & _
                " is invalid." & vbCrLf
          Next
       End If
     End Function
     '**************************************************
   End Class
%>

<%@ LANGUAGE = "VBSCRIPT" %>
<% Option Explicit %>
<!--#include virtual="/CODEREUSE/FormData.Class.asp"-->
<%
    'Instantiate our class defined in FormData.Class.asp
    Dim objFormData
    Set objFormData = New FormData

    'Test to see if form inputs are valid
    If objFormData.ValidInputs(  ) then
       'No form validation errors occurred!
       'Use Server.Transfer to send the user to the proper 
       'form validation script
       'If the user didn't specify a redirect, raise an error
       If Len(Request("Redirect")) = 0 then
          Raise vbObjectError + 1010, "Validation Error", "Redirect not specified"
       Else
          Server.Transfer Request("Redirect")
       End If
    Else
      'Display an error message
      Response.Write objFormData.ErrorMessage(  )
    End if

    Set objFormData = Nothing
%>