Why doesn't MaxLength work with multiline TextBoxes?

[danthman]

I have a TextBox set up as follows:

<asp:TextBox
ID="SubjectText Box"
TextMode="Multi Line"
MaxLength="100"
Columns="50"
Rows="2"
Wrap="true"
runat="server" />

The ideas is that users get 100 characters to specify their subject. In
fact, the content of this TextBox will get inserted into a database
field whose data type is VARCHAR(100).

Unfortunately, the MaxLength property gets disabled/ignored when the
TextMode is set to "multiline. " This isn't officially a bug, since it's
mentioned in the documentation, but it certainly is a design flaw in my
opnion.

Now I have to set up a validator to make sure the string isn't too
long, and users will have no idea they have typed too much until they
hit Submit and get an error message. I suppose I could say "max of 100
characters" next to the textbox, but this will clutter up the page,
and, assuming users even know what a "character" is, what are they
supposed to do, count?

I don't know if this is a Microsoft thing or just a limitation with
html, but I hope someone fixes it soon.

-Dan

[Jeff]

Re:
<<... Or would the user's attempt just simply not work and cause them to see
a cryptic error message?>>

How about "none of the above"...
What you can do is write code that checks the length of the incoming value
prior to any attempt to write to the database. When it's too long you can do
whatever you want... disallow the insert/update, return a message to the
user, whatever you want to do, really. The big point here is that you don't
have to worry about what will happen. Just validate everything explicitly
before attempting to save to the database. When the validation fails, take
whatever corrective action makes sense for your scenario.

-HTH

"danthman" <da******@cox.n et> wrote in message
news:11******** **************@ z14g2000cwz.goo glegroups.com.. .

Thanks, guys.

Okay, so tell me if I have this right...

The validation is done by the server. Users can send whatever they want
to the server by writing their own html files and loading them in their
browsers, but if I write validators to protect against all bad data,
they can't hurt me (well, not easily anyway).

I'm a littler hazier on the database issue though. If I send too much
data to the database, and it causes "buffer overflow or some other
wierd error," would this crash my server? Or would the user's attempt
just simply not work and cause them to see a cryptic error message?

I will definitely do my best to validate against all possible bad data,
but if I miss something, I hope it's at least very difficult to crash
the server. If it were just a matter of someone getting an unhandled
exception or something, I could live with that, especially if they did
something malicious to generate the exception :)

Anyway, thanks for the warning. I'll work on some stricter validators.

-Dan