Form Validation - Error Trapping Not Working.

[thomoose89]

Hi,

I'm a Coldfusion beginner desperately trying to get along with some database work for my site and have come across an annoying error that I just can't solve! I'm sure I'm missing something really basic - I just can't for the life of me figure out what it is!

Basically, I have a form for users to sign-up. I have introduced several cfif statements and a basic CAPTCHA system to trap errors. If any errors are submitted then they should be displayed in a cfwindow. This process works fine until I specify the form action - after which it is completely ignored and the form contents are written to the database without any validation taking place. Even without specifying the form action the errors won't show in Internet Explorer.

I really would appreciate any help - it's driving me crazy!

Thanks in advance,

Tom.

Here is the code:

<cfinclude template="CFIDE/headertemplate.cfm">

<!-- RANDOM NUMBER GENERATOR  FOR CAPTCHA -->

<cffunction name="makerandom" returnType="string" output="false">
<cfset var chars = "23456789ABCDEFGHJKMNPQRSTW">
<cfset var length = randRange(4,6)>
<cfset var result = "">
<cfset var i = "">
<cfset var char = "">
     
<cfscript>
     for(i=1; i <= length; i++) {
          char = mid(chars, randRange(1, len(chars)),1);
          result&=char;
      }
</cfscript>
         
<cfreturn result>
</cffunction>

<!-- ERROR TRAPPING -->

  <cfset showForm = true>
  <cfparam name="form.email" default="">
  <cfparam name="form.artistname" default="">
  <cfparam name="form.city" default="">
  <cfparam name="form.postcode" default="">
  <cfparam name="form.pass" default="">
  <cfparam name="form.captcha" default="">
  <cfparam name="form.captchahash" default="">
  <cfparam name="form.terms" default="">
 
<cfif isDefined("form.send")>
      <cfset errors = "">

<cfif len (form.email) LT '4'>
<cfset errors = errors & "You must include a valid e-mail address.<br />">
</cfif>

<cfif find('.',form.email) is '0'>
<cfset errors = errors & "Your E-mail features no . symbol.<br />">
</cfif>

<cfif find('@',form.email) is '0'>
<cfset errors = errors & "Your E-mail features no @ symbol.<br />">
</cfif>

<cfif not len(trim(form.artistname))>
<cfset errors = errors & "You must include your name.<br />">
</cfif>

<cfif not len(trim(form.city))>
<cfset errors = errors & "You must include your city.<br />">
</cfif>

<cfif not len(trim(form.postcode))>
<cfset errors = errors & "You must include your postcode.<br />">
</cfif>

<cfif not len(trim(form.pass))>
<cfset errors = errors & "You must specify a password.<br />">
</cfif>

<cfif len(form.pass) LT '6'>
<cfset errors = errors & "Password must be between 6 and 10 characters.<br />">
</cfif>

<cfif hash(ucase(form.captcha)) neq form.captchahash>
<cfset errors = errors & "You did not enter the correct Captcha text.<br />">
</cfif>

<cfif not len(trim(form.terms))>
<cfset errors = errors & "You must agree to our Terms and Conditions.<br />">
</cfif>

<cfif errors is "">
<cfset showForm = false>
</cfif>
     
</cfif>

<cfif showForm>
 
<cfset captcha = makerandom()>
<cfset captchahash = hash(captcha)>
 
<cfoutput>

<h1>Artist Sign-Up</h1>

<p>Your details are required for sign-up. Mandatory fields are indicated with a *.</p><br/><br/>

<cfif isDefined("errors")>

<cfwindow name="formerrors"
title="Form Errors"
width="450"
height="250"
modal="true"
initshow="true"
center="true"
closable="true"
minheight="200"
minwidth="200">

<center><b>Please correct the following errors and re-submit the form:</b><br /><br/>#errors#

<br/><a href="javascript:ColdFusion.Window.hide('formerrors');">Close Window</a>
</center>
<br/></cfwindow>

</cfif>

<!-- FORM CONTENTS -->

<cfform action="artist_insert.cfm" method="post">
<table class="signup">
<tr>
<td class="noborder" width="200">
  <label for="email">E-Mail Address*:</label>
</td>
<td class="noborder" width="156">

<input type="text" name="email" class="textbox" value="<cfoutput><cfif IsDefined("URL.email")>#URL.email#<cfelse></cfif></cfoutput>"/>

</td>
<td class="noborder">
<cftooltip autoDismissDelay="9999" tooltip="This needs to be a valid e-mail so that<br/> promoters can get in contact with you. <br/>If several people will be using this<br/> account then try and make it a shared<br/> address."><img src="pics/i.jpg" alt="info" border="1" /></cftooltip>
</td>
</tr>
<tr>
<td class="noborder" width="200">
  Your Password* (6 to 10 chars.):
</td>
<td class="noborder">
<input type="password" class="textbox" name="pass" maxlength="10"/>
</td>
<td class="noborder">

</td>
</tr>
<tr>
<td class="noborder" >
Artist/Band Name*:
</td>
<td class="noborder">
<input type="text" class="textbox" name="artistname" />
</td>
<td class="noborder">

</td>
</tr>
<tr>
<td class="noborder">
City*:
</td>
<td class="noborder">
<input type="text" class="textbox" name="city" />
</td>
<td class="noborder">
<cftooltip autoDismissDelay="9999" tooltip="Entering your locational details enables Gig<br/>Digger to find the events and promoters<br/>in your area. Try specifying a well known<br/>city nearby for the best results."><img src="pics/i.jpg" alt="info" border="1" /></cftooltip>
</td>
</tr>
<tr>
<td class="noborder">
Postcode*:
</td>
<td class="noborder">
<input type="text" class="textbox" name="postcode" maxlength="8"/>
</td>
<td class="noborder">

</td>
</tr>
<tr>
<td class="noborder">
Your Contact Number:
</td>
<td class="noborder">
<input type="text" class="textbox" name="contact" maxlength="14"/>
</td>
<td class="noborder">
</td>
</tr>
<tr>
<td class="noborder">
</td>
</tr>
<tr>
<tr>
<td class="noborder" valign="top" width="200">Please enter the CAPTCHA text in the box below*: </td>
<td class="noborder" align="left">
<center><cfimage action="captcha" width="156" height="50" text="#captcha#" border="1">
<input type="hidden" name="captchaHash" value="#captchaHash#"></center>
</td>
<td class="noborder" valign="top">
<cftooltip autoDismissDelay="9999" tooltip="This is here to ensure that<br/>you're human. It stops abuse <br/>of the site and makes it a safer <br/>place for us all."><img src="pics/i.jpg" alt="info" border="1" /></cftooltip>
</td>
</tr>
<tr>
<td class="noborder">
</td>
<td class="noborder" align="right"><font size="-2"><b><a href="javascript:location.reload(false)">Refresh Page</a></b></font>
</td>
<td class="noborder">
</td>
</tr>
<tr>
<td class="noborder"></td>
<td class="noborder"><input type="text" name="captcha" class="textbox"></td>
</tr>
<tr>
<td class="noborder">
</td>
</tr>
<tr>
<td class="noborder">
</td>
</tr>
<tr>
<td class="noborder" width="170">Please check this box to confirm that you agree<br/> to our <b><a href="termsandconditions.cfm">Terms and Conditions</a></b>*.
</td>
<td class="noborder">
<input type="checkbox" class="textbox" name="terms" /></td>
</tr>
<tr>
<td class="noborder">
</td>
</tr>
<tr>
<td class="noborder">
</td>
<td class="noborder" align="center">

<cfinput type="image" src="pics/submit.png" name="send" value="Submit" validate="submitonce" border="1">
</td>
</tr>
</table>

</cfform><br/>

</cfoutput>
     
<cfelse>
 
<cfoutput>
     
Thank you for submitting your details, #form.name#. You may now log in with your e-mail and password.
    
</cfoutput>
     
</cfif>

</td>
</tr>
</table>

<!-- FOOTER START -->

</body>
</html>

ARTIST INSERT PAGE - artist_insert.cfm

<cfquery datasource="071907cs07to">
INSERT INTO Artist(    Nsudate,
                    Nemail,
                    Npass,
                    Nname,
                    Ncity,
                    Npostcode,
                    Ncnumber
                    )

VALUES(    ( #Now()# ),
        '#Trim(form.email)#',
        '#Trim(form.pass)#',
        '#Trim(form.artistname)#',
        '#Trim(form.city)#',
        '#Trim(form.postcode)#',
        '#Trim(form.contact)#'
        )        
</cfquery>

[BreakawayPaul · Accepted solution]

Hi,

A few things to consider:

1) Look at the IsValid() feature.  It's a much better way to validate things like telephone numbers, email addresses, zipcodes, etc.

2) This one is important, please use <cfqueryparam tags for your database insert.  This helps strip malicious characters from the text that people are entering.  Always assume all data coming from a user is malicious.

3) For the error check, I would try this:

<cfif errors is "">
<cfset showForm = "false">
<cfelse>
<cfset showForm = "true">
</cfif>
      
</cfif>
<cfif showForm eq "true">
....

[Dan_Bracuk]

In addition to BreakawayPaul's answer.

You are making it very difficult to troubleshoot your if/else logic because your code includes all the display stuff.  Since you're a self proclaimed beginner, you might want to try another approach.

Save your old page and start a new one from scratch.  Solve all your logic problems first.  Display what you need to see with the cfdump tag.

Here are some hints to make the whole thing easier.

1.  In your cfform, use the validate and required attributes to catch errors earlier.

2. You don't have to cfparam every form field.  The form has either been submitted to it hasn't.  If it has, all the fields will be there with the possible exception of checkboxes or radio button, if nothing was selected.

[thomoose89]

Thank you both for your help. You're right, it is very patched together and needs stripping down to the basics.