Input Validation for Web Forms CASENET Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An online store has a discount code field in the checkout form. The discount code must be validated against a database of active codes, and the validation logic is complex because some codes are single-use and expire. The team wants to provide immediate feedback on the form without a postback. Which approach should they take?

   • AUse a CustomValidator with a server-side validation function that checks the database, and set EnableClientScript to true to allow client-side validation via a JavaScript function that calls a web service.
   • BUse a RequiredFieldValidator to ensure the field is not empty and rely on the server to reject invalid codes after form submission.
   • CUse a CompareValidator to compare the entered code against a hidden field containing the list of valid codes.
   • DUse a RegularExpressionValidator with a pattern that matches all valid discount code formats.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Why should detailed exception messages be hidden from end users?

   • ABecause they are written in a programming language users do not understand.
   • BBecause they may contain sensitive information that can aid an attacker.
   • CBecause they slow down the application.
   • DBecause they are too long for users to read.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A document management system allows users to upload files. The current implementation only checks the file extension to determine if it is an allowed type (e.g., .pdf, .docx). A security audit has identified that this is insufficient. Which additional validation should be implemented to improve security?

   • AUse a blacklist to block files with dangerous extensions like .exe and .asp.
   • BValidate the file content by checking the magic bytes or MIME type, and enforce a maximum file size.
   • CRename the uploaded file to a random name with a .txt extension.
   • DStore the uploaded files in a directory with execute permissions disabled.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An ASP.NET form collects a user's age. The age must be an integer between 18 and 120. The developer wants to enforce this on the server. Which approach is the most appropriate?

   • AUse a RegularExpressionValidator with pattern ^\d+$ to ensure only digits are entered.
   • BUse a RangeValidator with Type=Integer and MinimumValue=18, MaximumValue=120, and also validate in code-behind.
   • CUse a CompareValidator with Operator=GreaterThan and ValueToCompare=18.
   • DUse a RequiredFieldValidator and convert the input to an integer in code-behind, catching any exceptions.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A developer is creating a forum where users can post comments. The comments are stored in a database and later displayed on a page for other users. The developer wants to prevent stored XSS attacks. Which combination of actions is the most effective?

   • AUse a blacklist to remove common script tags like <script> and <iframe> from the comment before storing it.
   • BStore the comment in the database as-is and rely on the browser's built-in XSS filter to block malicious scripts.
   • CValidate the comment length and characters on the server, and HTML-encode the comment when rendering it in the page.
   • DUse JavaScript to replace all '<' and '>' characters with empty strings before the comment is submitted.
   Reveal Solution Discussion Select an answer first