Improving Web Application Security: Threats and - CGISecurity

Chapter 10: Building Secure ASP.NET Pages and Controls 265For more information about the full range of ASP.NET validator controls, refer to the.NET Framework documentation.RegularExpressionValidator ControlTo validate Web form field input, you can use the RegularExpressionValidatorcontrol. Drag the control onto a Web form and set its ValidationExpression,ControlToValidate, and ErrorMessage properties.You can set the validation expression using the properties window in MicrosoftVisual Studio .NET or you can set the property dynamically in the Page_Load eventhandler. The latter approach allows you to group together all of the regularexpressions for all controls on the page.Regex ClassIf you use regular HTML controls with no runat=“server” property (which rules outusing the RegularExpressionValidator control), or you need to validate input fromother sources such as query strings or cookies, you can use the Regex class either inyour page class or in a validation helper method, possibly in a separate assembly.Some examples are shown later in this section.Regular Expression CommentsRegular expressions are much easier to understand if you use the following syntaxand comment each component of the expression using #. To enable comments, youmust also specify RegexOptions.IgnorePatternWhitespace, which means that nonescapedwhite space is ignored.Regex regex = new Regex(@"^# anchor at the start(?=.*\d) # must contain at least one digit(?=.*[a-z]) # must contain one lowercase(?=.*[A-Z]) # must contain one uppercase.{8,10} # From 8 to 10 characters in length$ # anchor at the end",RegexOptions.IgnorePatternWhitespace);String FieldsTo validate string fields, such as names, addresses, tax identification numbers, and soon, use regular expressions to do the following:● Constrain the acceptable range of input characters.● Apply formatting rules. For example, pattern-based fields, such as taxidentification numbers, ZIP codes, or postal codes, require specific patterns ofinput characters.● Check lengths.