ASP.Net Validation on Multiple Controls

Let's talk about web sites and validation.  I'll start with the basics:

Whenever you have a web form, you must validate server-side.  This is because you can never trust anything sent from the user over the web.  The user could simply disable javascript, or a more malicious user might send a specially crafted HTTP request.  Either way, your server-side code needs to be prepared.

Additionally, you should validate client-side.  This is so you can provide faster, more dynamic feedback to user, and also to reduce the load on your server.  If you have some javascript that 99% of users run that catches an invalid form before submission, that's a good thing.

Unfortunately, this creates a burden for web developers.  There are now two places that need code to accomplish the same task.  That may seem petty to a non-developer who's only thinking about the initial creation work, but it really has a huge maintenance cost over the life of the app.  The problem is that it becomes real easy to make a change in one place and not the other, which results in a broken web site.

One of the nice things about ASP.Net is that much of the time you don't have to duplicate client-side and server-side validation.  It includes a set of generic validation controls that will automatically do the client-side and server-side work with one set of code.  Unfortunately, these controls have several limitations.

One limitation is that you can only validate one control at a time.  For example, let's say you have several fields on your form and want to require the user to enter data in at least one of them.  To do that right now you would need to use a CustomValidator control, which usually also means writing separate javascript or not validating client-side.  Another limitation is that they won't validate checkbox controls (you can get around this now by attaching a custom validator to a random textbox, but that's an ugly hack).

So what is a developer to do?  Well, in my case, I derived a new generic validation control: the AtLeastOneOfValidator.  Since one of my main problems with Vox right now is that it's not easy to post code, I created a separate write-up for the control and posted it over at codeproject.  Anyone can read the full details there now, and if you create a (free, non-intrusive) login you can download the code and binary.  Here are some of the highlights:

1. In addition to the normal controls supported by validators, it will accept CheckBox, CheckBoxList, RadioButton, RadioButtonList, and Calendar.  You could use it to require a checkbox (for example, "check this to accept terms") by including the checkbox as the only control with the validator.
2. It uses simple dropdown lists to select supported controls, just like any other validator control (I'm a little proud of myself for getting that working, even though it turned out to be pretty easy), up to ten controls.  Beyond 10 controls there is a string property you can use to enter a comma-delimited list of control names.
3. Client-side validation works for everything but the calendar control.  If you use the calendar control, it will post back to the server to finish validation.  Since the stock calendar control pretty much sucks and posts back all the time anyway, this shouldn't really surprise anyone.  I debated with myself whether to support this control at all.

The control has been tested to work well with IE7 and the latest FireFox 3 (beta 2 at the time of writing). I'm looking for people to test in FireFox 2 and older, IE6, the IE8 beta, Opera, Safari, Nautilus, and Camino.  If you see this and can put the control through it's paces in any of those platforms, please post a comment to let me know how it goes.

Once again, you can get the details here.