Input Validation for Web Forms CASENET Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A developer needs to validate a phone number field. Which technique is most appropriate to ensure the input matches a specific pattern?

   • ARegular expression validation that defines the allowed format.
   • BUsing a blacklist of disallowed characters.
   • CEncoding the input before storing it.
   • DBlacklist validation that rejects common malicious strings.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A development team is building a web application that accepts user input in a search form. The team has implemented client-side validation using JavaScript to ensure the input is alphanumeric. However, the security team has mandated that server-side validation is essential. The team argues that client-side validation is sufficient because it prevents most users from entering invalid data. Which argument should the security team use to justify the mandate?

   • AClient-side validation is more prone to errors because JavaScript is not type-safe.
   • BClient-side validation is slower than server-side validation, causing a poor user experience.
   • CClient-side validation can be bypassed by disabling JavaScript or sending crafted HTTP requests directly to the server.
   • DClient-side validation cannot handle complex validation rules such as database lookups.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In ASP.NET, which validation control allows you to define a pattern that the input must match?

   • ACompareValidator
   • BCustomValidator
   • CRegularExpressionValidator
   • DRequiredFieldValidator
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An ASP.NET web form has a text box for a phone number. The requirement is that the phone number must be 10 digits, optionally separated by dashes (e.g., 123-456-7890). The developer wants to use ASP.NET validation controls. Which approach should be used?

   • AAdd a RequiredFieldValidator and a RangeValidator to ensure the value is between 1000000000 and 9999999999.
   • BAdd a CustomValidator that checks the length of the input is exactly 12 characters.
   • CAdd a RegularExpressionValidator with pattern ^\d{3}-?\d{3}-?\d{4}$ and set EnableClientScript to false, then validate the same pattern in code-behind.
   • DAdd a CompareValidator with Operator=DataTypeCheck and Type=Integer to ensure the value is numeric.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A developer is implementing error handling for a web form that processes credit card payments. The form includes fields for card number, expiry date, and CVV. The developer wants to ensure that error messages do not expose sensitive information. Which approach is the most secure?

   • ADisplay the exact error message returned by the payment gateway to help the user understand the issue.
   • BDisplay generic error messages for validation failures, and log detailed errors to a server-side log with appropriate access controls.
   • CRedirect the user to a custom error page that shows the stack trace for transparency.
   • DUse a try-catch block that catches all exceptions and displays the exception message to the user.
   Reveal Solution Discussion Select an answer first