Why is HTML showing in the form validation message?

[Grant]

Here is what is showing when I use server side form validation.

<ul><li>You must select a location </li></ul> Go <a href="javascript:history.back()">back</a> and correct the problem.

Obviously, the HTML tags are not supposed to be shown.  What's going on here?  I just upgraded to CF9 on Linux and this started happening.  Any ideas?

[Grant]

Anybody?  Seems like this would be a common problem and maybe I'm missing something simple.

[Adam Cameron.]

It's impossible to really comment on this without you providing some (stand-alone, self-contained) steps to reproduce this.  Otherwise we need to just guess what you're code says (which is a mug's game).

--

Adam

[Grant]

It's a standard CF server-side form validation and looks like this on the form:

<input type="hidden" name="somefield_required" value="some field is a required field">

When they submit the form (and didn't enter something for somefield), the automatic message comes up.  The formatting of the message is messed up on CF9.  I've been using this type of server-side validation for years (probably since CF5) and have never seen this problem before.

Actually, this works fine on another server (CF 9,0,0,251028) but on CF 9,0,1,274733 it is having this issue.  Both are running CF Enterprise on Linux.

Error message is supposed to look like this:

Form entries are incomplete or invalid.

• some field is a required field

Go back and correct the problem.

The messed up message looks like this:

Form entries are incomplete or invalid.

<ul><li>some field is a required field</li></ul> Go <a href="javascript:history.back()">back</a> and correct the problem.

[cfsilence]

It's because you named your field xxx_required.  the "_required" part is triggering the server side validation just as "_date" would for example --  read up on server side validation (or better yet, just turn it off and roll your own).

[Grant]

Yes, I'm TRYING to use server-side validation.  That's not the issue.  The problem is that HTML is showing up in the message.

[cfsilence]

Weird.  Sounds like the perfect time to upgrade your codebase to not use it then?

[JR__Bob__Dobbs]

Can you post some sample code that can reproduce the problem?

[Adam Cameron.]

Yeah.  A complete and self-contained repro case would help here, in case we're making assumptions about the OP's code that're incorrect.

--

Adam

[Grant]

Here you go:

<FORM ACTION="testprocess.cfm" METHOD="post">
<input TYPE="Text" NAME="somefield">
<input TYPE="Submit">
<input TYPE="Hidden" NAME="somefield_required" VALUE="some field is a required field">
</FORM>

When you submit a blank form, this is the error (the HTML markup showing up is the problem):

Form entries are incomplete or invalid.

<ul><li>some field is a required field </li></ul> Go <a href="javascript:history.back()">back</a> and correct the problem.

The processing page is blank (makes no difference what's on there).

Why would I roll my own server-side form validation if it's built in?

[Adam Cameron.]

Why would I roll my own server-side form validation if it's built in?

Because the user experience when using this built-in stuff is rubbish & looks amateurish?

--

Adam

[Owainnorth]

Why would I roll my own server-side form validation if it's built in?

And because you easily could've just written it by now?

[cfsilence]

Adam Cameron. wrote:

Why would I roll my own server-side form validation if it's built in?

Because the user experience when using this built-in stuff is rubbish & looks amateurish?

--

Adam

Yeah, and the fact that it's seriously limited.  What happens when you need to validate that a username is unique or that passwords match, or anything other then the built it stuff?

[JR__Bob__Dobbs]

A couple of comments.

1. I am able to reproduce the bug behavior in CF 8.0.1 on Windows. You may wish to submit this to Adobe.

2. I would avoid using the built-in "server validation". It can be bypassed by the user and is not proper server side validation. He/she can edit the HTML at the client to remove the hidden form fields then submit the form without the "required" items.

3. If you are looking for an alternative you could 1) write your own validation, 2)use an open-source project such as "Validate This", or 3) search for options at RIA Forge or another open-source project site.

Validate This (Disclaimer: I have not used this project)

http://validatethis.org/

RIA Forge

http://www.riaforge.org/

[Grant]

1. Thank you for confirming the problem on your server.  That means it's not me, it's the software.

2. I realize that the built-in validation is not foolproof and is very limited.  However, for required fields or fields that must be integers, etc., it is a quick and easy way to let the user know that something is missing/wrong.  Assuming you are using CFPARAM on the processing pages and/or have required database fields, bad/missing data is not going to get through anyway.   You can, of course, also use the built-in client-side javascript validation on the forms.  These are reasons why people use ColdFusion--because it's quick and easy to do common tasks like this.

3. Thanks for the suggestions.

[Adam Cameron.]

Dunno what the problem is, but it's something to do with your install.  it works fine on both CF8.0.1 and CF9.0.1 for me.

I'm afraid I dunno what underlying mechanism CF uses when it does this sort of validation, as I never use it (and, to be frank, I hadn't heard of anyone using the type of validation for about ten years), so I don't know what to suggest.

--
Adam