2

How to protect an asp:textbox from user input?

DISABLE IT

<asp:TextBox ID="txbx" runat="Server" Text="1" Enabled="false" />

PROTECT IT

<asp:TextBox ID="txbx" runat="Server" Text="1" ReadOnly="true" />

I wish to protect the textbox as above from user input but still allow the value to be updated with javascript.

This works fine so what's the problem?

THE PROBLEM

If a textbox is disabled or readonly the updated values will not post to the server when submitted!

QUESTION

How to create a textbox that can simultaneously:

  • Be visible to the user.

  • Be protect from user input.

  • Be updated with javascript.

  • Post updated value to server.

ANSWER

The conflict occurs because when you set enabled="false" on control it is does not pass the values to the server.

However setting disabled or readonly clientside does not cause this issue.

You can set the properties clientside by using:

In code behind:

txbx.Attributes.Add("ReadOnly", "ReadOnly")
txbx.Attributes.Add("disabled", "disabled")

or by using client side controls and setting them to runat server:

<input type="text" id="txbx" readonly="readonly" runat="server" />
<input type="text" id="txbx" disabled="disabled" runat="server" />
DreamTeK
  • 32,537
  • 27
  • 112
  • 171
  • Is this vb or C#. I can tell you in Visual Basic. You can convert to C# then, there are many VB to C# converters if it is in C#. – Kashish Arora Feb 28 '14 at 13:53
  • Are you sure that the updated value does not get posted back? I have used ReadOnly = "true" and updated using jQuery and never had an issue. – Mych Feb 28 '14 at 13:53
  • 1
    @KashishArora VB is preferable thank you – DreamTeK Feb 28 '14 at 13:53
  • @Mych yes all works fine when readonly is removed. This is a follow up post from here: http://stackoverflow.com/questions/22095888/posting-changed-values-of-a-disabled-control-in-asp-net – DreamTeK Feb 28 '14 at 14:08
  • After a bit of experimenting standard asp:TextBox will not postback a clientside update value while ReadOnly = True yet a Telerik Texbox control does. I extensively use Telerik and therefore was confused when you had this issue. – Mych Feb 28 '14 at 16:00
  • @Mych You help is appreciated none the less. – DreamTeK Feb 28 '14 at 16:20

6 Answers6

7

I once got out of this situation by setting the ReadOnly property from code-behind. You can try this once.

txbx.Attributes.Add("ReadOnly", "ReadOnly");

Add this line of code in your Page_Load event.

Please inform if it works for you.

Atanu Roy
  • 1,384
  • 2
  • 17
  • 29
  • Downvote was a little harsh as this actually solves the issue in the cleanest and most efficient way. It wasn't me btw. – DreamTeK Feb 28 '14 at 14:14
  • For me, this does not work because the 'txtbx' control has not been initiated yet, and using the DetailsView.FindControl() always comes back null in the Page_Load events. Any other suggestions? – Fandango68 Jun 02 '15 at 00:41
  • If you are writing this code in Page_Load() event, your control should already been initiated. If you are dynamically creating this control, write this code after initiation logic. That should work. It would be helpful if you share your piece of code. @Fernando68 – Atanu Roy Jun 12 '15 at 10:17
  • REMINDER: If it is not YOUR question, do not down vote it, because it doesn't work for you. – snowYetis Oct 06 '16 at 16:53
0

Not very well know for some reason, but ASP.NET has special property which controls if disabled controls being sent back to the server or not: HtmlForm.SubmitDisabledControls

So what you have to do is set this property to true for your Form control

<form id="form1" submitdisabledcontrols="true" runat="server">
    <asp:TextBox ID="txbx" runat="Server" Text="1" ReadOnly="true" Enabled="false" />
</form>
vittore
  • 17,449
  • 6
  • 44
  • 82
  • @DreamTeK put that in your question then, as well as other details which may be relevant. – vittore Feb 28 '14 at 14:04
  • Thanks for your help. I did not add this property because in my previous post I was made aware that the submitdisabledcontrols does not submit updated values with javascript. So I created this post to prevent confusion. http://stackoverflow.com/questions/22095888/posting-changed-values-of-a-disabled-control-in-asp-net – DreamTeK Feb 28 '14 at 14:12
0

The easiest solution, in my opinion, is to have a hidden field and read that on postback instead, that way the protected textbox is just cosmetic, the actual logic is working with a hidden field.

That said, ReadOnly = true should still work on postback, it's only Enabled = false which shouldn't postback the value.

Tobberoth
  • 9,327
  • 2
  • 19
  • 17
0

you can use html input element instead, and set runat attribute to server to refer that from server ,like this:

<input type="text" name="name" id="text2" readonly="readonly" runat="server" />

its value, will be sent to server after its changed on client, while it has set as readonly

Amir Sherafatian
  • 2,083
  • 2
  • 20
  • 32
-1

Beware: <form> does not send data for disabled inputs.

My personal solution:

  • Make original field invisible with JS

  • Write new field with the original value and make it disabled, just for show.

    var status = document.getElementById("ElementID");
status.style.visibility='hidden';
var row = status.parentNode.parentNode;
var newCol = row.insertCell(-1);
newCol.innerHTML = "<div style='padding-left: 6px'><input readonly='readonly' type='text' size='50' value='" + status.value + "' class='inputReadOnly'/></div>";
Gordon Mohrin
  • 645
  • 1
  • 6
  • 17
-2

Be visible to the user.

<asp:TextBox ID="txbx" runat="Server" />

Be protect from user input.

<asp:TextBox ID="txbx" runat="Server" Text="1" Enabled="false" />
<asp:TextBox ID="txbx" runat="Server" Text="1" ReadOnly="true"  />

Be updated with javascript.
create a function and use like

<script type="text/javascript">
        var a = ($("#<%=txbx.ClientID%>"));
        a.value="assas";
</script>

Post updated value to server.
same as above

flx
  • 14,146
  • 11
  • 55
  • 70
dipz
  • 11
  • 5