Hi.

I want to use the RegularExpressionValidator to pick up on pattern matches that will result in a page error because of ValidateRequest="true" page directive.

This in order to give the user a more user friendly error message than would result if the serverside safeguards hits it.

Now, the thing is that that I have a number of potential RegEx matches that I want to INVALIDATE the text with the resulting error message client side (html tags or escape code equivalents).

I cannot see any options on the RegExValidator to set "Valid if no matches".

Am I going about this the wrong way? Surely, this must be a common problem.

There is no built in way to tell the RegularExpressionValidator to invert the results. Yet there are solutions.

Use a CustomValidator. You can call the Regex.IsMatch method in your validator's ServerValidate method and invert the result that you assign to args.IsValid. You may want to avoid creating a client-side version of the validation function to avoid exposing your logic to a hacker. (Hackers are pretty good at finding limitations of code when you show it to them.)

FWIW: I have created a commercial alternative that has very intense Cross Site Scripting and SQL Injection attack defenses in case you are looking at all options. Even if you don't want to buy something, you may learn alot by reading its User's Guide as it exposes you to a variety of attacks that you may not have thought of. (My code ends up running several regular expressions because there isn't a single expression that can handle all the cases.)

Thank you for your answer.

 I'm a bit confused about this, though, so I need to ask a stupid question. Will the customvalidator run client side? Because the point is to avoid a roundtrip with a data payload that the serverside safeguards will deem to be "unsafe". At least, I assume that to be the point. I'm aware that the regularexpressionvalidator is not an ajax control, so I have no well founded reason to assume that the customvalidator and regexvalidator behave principally differentally.

I'm not really concerned about someone finding a way to cheat the validator, because the point is to avoid good-behaving users getting the cryptic error message that results in hitting the Page.ValidateRequest directive safeguard. It's just a matter of presenting an agreeable error message on the AJAX extender as opposed to getting iexplorer Error 500.

I appreciate your time.

The CustomValidator can be setup to run a javascript function that you define. That's where you will call the javascript regular expression object.

Here are some resources:

Customvalidator class overview

Javascript regular expressions