Improving Web Application Security: Threats and - CGISecurity

266 Part III: Building Secure Web ApplicationsNamesThe following example shows a RegularExpressionValidator control that has beenused to validate a name field.The preceding validation expression constrains the input name field to alphabeticcharacters (lowercase and uppercase), the single apostrophe for names such asO’Dell, and the dot character. In addition, the field length is constrained to 40characters.Social Security NumbersThe following example shows the HTML code that is generated for aRegularExpressionValidator control that has been used to validate a U.S. socialsecurity number form field:The preceding validation expression is one of the standard expressions that VisualStudio .NET provides. It validates the format of the supplied input field as well as itstype and length. The input must consist of three numeric digits followed by a dash,then two digits followed by a dash, and then four digits.If you are not using server controls (which rule out the validator controls), or youneed to validate input from sources other than form fields, you can use theSystem.Text.RegularExpression.Regex class in your method code. The followingexample shows how to validate the same field by using the static Regex.IsMatchmethod directly in the page class rather than using a validator control:if (!Regex.IsMatch(txtSSN.Text, @"\d{3}-\d{2}-\d{4}")){// Invalid Social Security Number}