Custom validation not working properly

Question

I have written custom validation for preventing users to save the information in the database if entered login email address(user name ) is already existing in the database.

 <div class="span3">
                            <asp:TextBox ID="txtLoginEmailAddress" class="SearchTxtBox" runat="server" Text='<%# ds.Tables[0].Rows[0]["LoginEmailAddress"] %>'
                                MaxLength="50"> </asp:TextBox>
                         </div>
                         <div class="span6">
                            <asp:RequiredFieldValidator ID="valLoginEmailAddressRequired" runat="server" CssClass="Validator"
                                ValidationGroup="save" Display="Dynamic" ControlToValidate="txtLoginEmailAddress"
                                ErrorMessage="<b>User Name is required</b>"></asp:RequiredFieldValidator>
                             <asp:CustomValidator ID="CheckAvailablity" runat="server" ValidationGroup="save" ControlToValidate="txtLoginEmailAddress"
                              OnServerValidate="ValidateUserName"></asp:CustomValidator>

             <asp:Label ID="valDuplicatePassword" runat="server" style="color:red" Visible="False"></asp:Label></td>
                        </div>

       <asp:Button ID="btnSave" runat="server" Text="Save" CssClass="btn btn-small " OnClick="btnSave_Click"
                                ValidationGroup="save" />

in cs file

       protected void ValidateUserName(object sender, ServerValidateEventArgs e)
    {
        SystemUserBL bl = new SystemUserBL(SessionContext.SystemUser);
        ds = new DataSet();
        bl.FetchForLoginEmailAddress(ds, txtLoginEmailAddress.Text);

        if (ds.Tables[0].Rows.Count > 0)
        {
            e.IsValid = false;
            valDuplicatePassword.Visible = true;
            valDuplicatePassword.Text = "<b>This User Name is already in use by another user.</b>";
            btnSave.Enabled = false;
            btnSaveclose.Enabled = false;
        }
        else
        {
            e.IsValid = true;
            btnSave.Enabled = true;
            btnSaveclose.Enabled = true;
            valDuplicatePassword.Visible = true;
            valDuplicatePassword.Text = "<b>Congratulations! " + txtLoginEmailAddress.Text + " is available.</b>";
        }
    }

       protected void btnSave_Click(object sender, EventArgs e)
    {
        try
        {
            if (save())
            { 
              SucessMessage();
            }
        }
        catch (Exception ee)
        {
            ErrorMessage(ee.Message);
        }
    }

Now when we click save button it displays validation message after saving it in the database. I want that it should not be saved in the database and custom validation should work like other ASP.NET's validations. Please help !!!

Answer 1

You have to explicitly check that the page is valid before continuing your processing. So in your case:

protected void btnSave_Click(object sender, EventArgs e)
{
    try
    {
      if (this.IsValid()) //this checks that the page passed validation, including custom validation
      {
        if (save())
        { 
          SucessMessage();
        }
      }
      else
      {
        //any custom error message (additional to the validators themselves) should go here
      }
    }
    catch (Exception ee)
    {
        ErrorMessage(ee.Message);
    }
}

Strictly this applies to all ASP.NET validators, but especially when, as in your case, you are not using client-side validation, you're more likely to encounter this issue. Even if your validators do have client-side enabled, you should make this check anyway - it's easy for a malicious user to bypass client-side validation and submit invalid data.

See this blog for a more detailed discussion of this topic: https://www.jardinesoftware.net/2012/03/31/net-validators-dont-forget-page-isvalid/