Reputation: 13
I have a fairly complex form (user control actually) with one textbox control on it that needs to NOT post back. Is there a way to remove a control from the post? Yes, this textbox is editable.
More info: This is for a credit card processing form, so the "final" submit will post to another site's page. However, prior to this there is plenty of server-side processing that goes on. I know that I can move the the credit card number text box to another page - but this requirement came very late and I'll trying to not have to re-work a lot of things.
Upvotes: 1
Views: 2979
Reputation: 9166
So the situation is that you have a form that is rendered in the user's browser with an action pointing to a different site and you need to make sure that one of the form fields will not be sent when the form is submitted.
Sounds to me like you cannot in that case make absolutely sure that the value is not posted. There are many different possible ways to solve this using javascript (disable input, clear value, etc before submit) but if scripting is turned off I think you're out of luck.
But since you can prepare for sending the form to the other server (change action on form or enable button with PostBackUrl), I guess you could also then set the Enabled property on the textbox to false. That would mean that it can no longer be edited on the final page beforr posting to the other server. Or you could hide the textbox a (so it's not renered at all) and show the field as a label or literal instead.
But even then you still have to somehow make sure the secret value is not included in the viewstate of the form. Which it will be in case you use a label or literal. And also for a textbox that was disabled or hidden on the last postback. Normally the viewstate is just a base64 encoded string so it would be trivial to find the credit card number from there. You could probably fix this by turning off viewstate for the control in question (or even for the whole page) in the last post back to your page before setting the form up for posting to the other server.
If you cannot tell for sure which will be the last postback to your server, then I think you're out of luck without more significant changes. Sorry to be a downer. Some seemingly trivial things are just hard with Asp.Net web forms.
Maybe you could add a separate page that you populate with just the data that you need to send to the other server and have that a sort of "Confirmation page". In that page you could turn off viewstate, show all the data summarized (using labels and literals etc) and the actual data to post could be included in the form as hidden fields. Then that form would post to the other server when the user "Confirms".
Upvotes: 0
Reputation: 3141
The easiest way would be to use an html input as opposed to an ASP TextBox. These are not accessible from code if runat="server"
is not set on them.
Or use the viewstate property (http://msdn.microsoft.com/en-us/library/system.web.ui.control.enableviewstate.aspx)
Upvotes: 2