Server-Side Data Validation

[mabster]

Hi gang,

I have a web service class I'm developing along the same lines as that
described here in MSDN:

http://tinyurl.com/63sl4

http://msdn.microsoft.com/library/en...alkthrough.asp

That is, it has a GetXXX method that returns a dataset, and an UpdateXXX
method that takes a dataset and applies it to the database.

Works fine so far. I'm very happy.

However, one thing I'd like to do is some validation of individual
fields at the server side before the entire dataset is posted back.

For example, if my web service was to manage purchase orders, it would
be nice to ask my web service if a particular product was available to
order before I hit OK on my 'new order' form.

I guess my first instinct was, "Why not just pull down all the valid
products as another dataset and validate the entered product# against
them?"

That works fine for small datasets, but what if there are a million
active products? I'd much prefer to write an IsValidProduct webmethod
and be able to call that just after the user enters the product number.

How are others implementing validation like this? Should the method be:

[WebMethod]
public bool IsValidProduct(int prod)
{
// return true if valid, false if not
}

or

[WebMethod]
public bool IsValidProduct(int prod, out string Error)
{
// return true if valid, false if not, and populate Error
// with meaningful string
}

or

[WebMethod]
public void ValidateProduct(int prod)
{
// if product is not valid, raise exception
}

Any pointers?

Thanks,
Matt

[Mujtaba Syed]

Hi Matt:

[WebMethod]
public bool IsValidProduct(int prod)
{
// return true if valid, false if not
}
This is good (if you don't want to pass a status message back).
[WebMethod]
public bool IsValidProduct(int prod, out string Error)
{
// return true if valid, false if not, and populate Error
// with meaningful string
}

Hmm... You won't be able to consume this web method from a VB.NET client
(you will have to use an initialized ByRef parameter). Also, you will need
to specify the SoapRpcMethod attribute with this web method, making it
non-conformant with WS-I Basic Profile 1.1

A better way is:

class Status
{
public bool isValid;
public string message;
}

public Status IsValidProduct (int productId)
{
//...
}
[WebMethod]
public void ValidateProduct(int prod)
{
// if product is not valid, raise exception
}

Don't use exceptions for program flow.

Hope this helps,
Mujtaba.

[mabster]

Mujtaba Syed wrote:

Hi Matt:

public bool IsValidProduct(int prod)
This is good (if you don't want to pass a status message back).

Yeah, but it's pretty useless to the end-user if I don't. Next ...

public bool IsValidProduct(int prod, out string Error)

Hmm... You won't be able to consume this web method from a VB.NET client
(you will have to use an initialized ByRef parameter). Also, you will need
to specify the SoapRpcMethod attribute with this web method, making it
non-conformant with WS-I Basic Profile 1.1

Sounds like work :) Next ...
A better way is:

class Status
{
public bool isValid;
public string message;
}

public Status IsValidProduct (int productId)

Ok, that sounds reasonable. Does the FCL define a type similar to your
'Status' example above for this sort of thing? It sounds like a common
enough task.

[WebMethod]
public void ValidateProduct(int prod)
{
// if product is not valid, raise exception
}

Don't use exceptions for program flow.

Yeah, I didn't like that last one either.

That said - it makes sense to raise an exception in the UpdateXXX method
if data is invalid, right? I mean, the UpdateXXX method *expects* valid
data - anything else has to be an exception.

Thanks for you reply!

Matt