ASP.NET Validation in Depth

http://msdn.microsoft.com/en-us/library/aa479045.aspx#aspplusvalid_serverside

Server-Side Validation Sequence

It is important to understand the life cycle of a page. For those used to working with forms in Visual Basic or similar rich client tools, it takes a bit of getting used to. A page and all the objects on it do not actually live for as long as a user is interacting with them, although it can sometimes seem like they do.

Here is a simplified sequence of events when a page is first accessed:

1. Page and its controls are created, based on ASPX file.
2. Page_Load event fires.
3. Page and control properties are saved to a hidden field.
4. Page and controls are turned into HTML.
5. Everything is thrown away.

Now, when a user clicks on a button or similar control, it goes back to the server and does a similar sequence. This is called the post-back sequence:

1. Page and its controls are created based on ASPX file.
2. Page and control properties are recovered from hidden field.
3. Page controls are updated based on user input.
4. Page_Load event fires.
5. Change notification events fire.
6. Page and control properties are saved to a hidden field.
7. Page and controls are turned into HTML.
8. Everything is thrown away again.

Why don't we just keep all objects in memory? Because Web sites build with ASP.NET would not work with very large numbers of users. This way, the only objects in memory on the server are things being processed right now.

When does server-side validation take place? Well, it does not take place at all on the first page fetch. Most of our end-users are very diligent, and we want to give them the benefit of the doubt that they will fill in the form correctly before we bombard them with red text.

On the post-back, validation takes place during step 5, just before the event fires for the button or control that triggered the validation. Button controls in ASP.NET have a property called CausesValidation that defaults to True. It is the action of clicking on buttons that makes validation happen. The best place to check the results of validation is in the event handler that triggered the validation.You can also have buttons with CausesValidation=False, that will not cause any validators to be evaluated.

One potentially confusing thing about this timing is that the validators will not have been evaluated at the time Page_Load is triggered. The benefit of this is that it gives you a chance to programmatically change property values affecting the validity of the page, such as enabling or disabling certain validators.

If this timing is not to your liking and you prefer to evaluate everything in Page_Load,you can do this by explicitly triggering the validation during this event by calling Page.Validate. After this has been called you can then check the result of Page.IsValid. If you try to query the result of Page.IsValid before Page.Validate has been called, either explicitly or being triggered by a button with CausesValidation=True, then its value is meaningless, so an exception will be thrown.

The Client-Side Sequence

This is the sequence of events when a page with client-side validation runs:

1. As the page is loaded into the browser, there is some initialization done on each validation control. The controls are emitted as <span> tags with HTML attributes that correspond closely to their properties on the server. The most important thing that happens here is that any input elements referenced by the validators are "hooked up." The referenced input elements have their client events modified so that the validation routines are called whenever the input is changed.
2. Code in the script library will be executed as users tab from field to field. The validation conditions are re-evaluated when a dependent field is changed, and the validator is made visible or invisible as appropriate.
3. When the user pushes a button that has the CausesValidation property set to True, the validators are all re-evaluated. If they are all valid, then the form is posted to the server. If there are one or more errors, a number of things happen:
   • The submit is cancelled. The form does not get posted back to the server.
   • Any invalid validators become visible.
   • If there is a validation summary with ShowSummary=true, it will collect all the errors from the validation controls and update its contents with them.
   • If there is a validation summary with ShowMessageBox=true, it will collect the errors and display them in client message box.

Because they are executed whenever the inputs change as well as at submit time, client side validation controls generally evaluate two or more times on client. Remember that they will still be re-evaluated on the server once the submit takes place.