When using ASP.NET Validator Controls... if (Page.IsValid) { Now it's safe to go on! }
It's not often I like to display my ignorance in public but in this case it's worth it. I've been using ASP.NET Validator controls for a while now with the knowledge that they provided me with an easy way to do both client-side and server-side validation in one step. I never bothered to get to deeply involved in the documentation about them because I thought how difficult can they possibly be to use. Well the truth is not difficult at all, if you know how to use them. The implicit client-side validation that they cause fooled me into believing that the validation occured the same way on the server-side as well. In other words, a page will not submit until the data is verified. Then I read this today in Fritz Onion's Essential ASP.NET book:
"As soon as you place a validation control on a page, it is imperative that you check the IsValid flag of the Page class before using any of the data posted by the client. It is a common misconception that if validation fails on a page, the code for that page will not execute. On the contrary, the only thing that happens when server-side validation fails is that the IsValid flag of the Page class is set to false, and each validation control that failed renters itself as a visible span so that the error indicator shows up when the page is redisplayed to the user."
I was under that misconception. Well sort of. I thought that the page would execute but as soon as an invalid control was hit, the page would rerender to the user and the proper messages would be displayed. Fritz Onion explains that if the client browser does not support JavaScript or a malicious user removes your JavaScript, no client side validation will occur and therefore you must ensure that IsValid == true on the server-side. Please also be congnizant of the fact that you must wait until the Page class calls it's Validate() method, which occurs after the Page.Load event fires, or explicitly call Validate() on the page yourself prior to checking the Page.IsValid property.
I hope I help to dispel this misconception. It's a trap that is all too easy to fall into.