Skip to main content
February 26, 2008
Question

cfinput pattern validation broken

  • February 26, 2008
  • 1 reply
  • 473 views
Correct me if I am wrong, but from my tests it appears the cfinput pattern validation is broken. Basically, ColdFusion will only match the very minimum amount of the string to be checked as possible to make the pattern match.

So pattern "[A-Z]+" matches "John123" even though it should fail. I've attached some code that shows an example in action.

    This topic has been closed for replies.

    1 reply

    Inspiring
    February 26, 2008
    > So pattern "[A-Z]+" matches "John123" even though it should fail. I've
    > attached some code that shows an example in action.

    It's not a bug, it's doing exactly what you're telling it to do. You're
    just telling it to do the wrong thing. "[A-Z]+" does not say "the entire
    string must match this pattern", it's saying "somewhere in the string must
    match this pattern". If you want to match the entire string, your regex
    has to reflect that, eg: "^[A-Z]+$".

    --
    Adam
    February 26, 2008
    Not completely true. The isValid(regex, string, pattern) Method returns false on my example. Why? Because when validating a string against the pattern, it makes sense to fail validation if the entire string does not match the entire pattern. Your pattern does work (I thought I had already tried to use ^ and $). However, it's still bizarre for ColdFusion to implement the function isValid differently than the validation attribute of cfinput.

    Thanks for the help.
    February 26, 2008
    Thanks for the reply Adam.

    I've come to the same conclusion as well. cfinput works correction, and of course javascript is generated and is what will match the string to the expression. So the cfinput functionality is what is expected. However, the isvalid function should be changed (and I noticed there are already known issues with that method).

    cfinput could be updated to be consistent with other CF methods by appending the ^ and $, but it's better to allow the developer to choose.