Ben Forta

One of the areas in which Blackstone should (I won’t say “will” until we ship as stuff could always change, so “should”) make our lives considerably easier is form field validation. I mentioned input masking a few days ago, and validation enhancements a while back. Both of these should play an important part in form field validation, input masking helps ensure that correct data is entered in the first place, and server-side validation via is the must-have last safeguard (you must never rely solely on client-side validation).
But that is not all, in Blackstone we also plan to simplify client-side and automatic server-side validation. But first, a review of how these are done right now.
Server-side validation is not optional, as already said you must never rely solely on client-side validation. Server-side validation can be as simple as a bunch of statements or tags on the action page, although it can get far more complex if needed. This type of validation provides the utmost control over both the validation testing, as well as the actions to occur if validation fails. ColdFusion also supports a simpler form of server-side validation, one that does not require code on the action page, and rather, uses validation instructions embedded in the form itself. For example, to make a field required you could do the following:

ColdFusion uses the hidden field as a validation instruction, and if login is not specified (in this example) the error message “Login is required!” would be displayed. This functionality has been in ColdFusion since the very early days, and a variety of validation types are supported. The upside of this feature is that the validation rules are within the form, as opposed to on the action page, and this makes keeping the rules and forms in synch much easier. The downside is that they are not failsafe (it would be possible to submit forms without those hidden fields), and there is limited control over how error messages are displayed.
Client-side validation is designed to make the experience better for the end-user. It must never be relied on as the only validation mechanism, but being able to trap errors before form submission does make for an improved user experience. ColdFusion supports client-side validation using JavaScript. While many users write their own JavaScript validation, ColdFusion has long been able to generate basic JavaScript validation code for you. (And although some ColdFusion developers stay away from and like the plague, the tags and the code is actually very good). So, the following code uses to make a field required:
In addition to the “required” flag, supports a range of validation rules via the “validate” attribute.
Thus far is what is supported in ColdFusion today. So, what does Blackstone change? Well, several things.
For starters, lots more validation types are planned, including the oft requested email and url.
In addition, the JavaScript error message that is displayed when using client-side validation will display all validation errors at once, not just the first.
But perhaps more importantly, it should be simpler to perform both client-side and server-side validation at once. has a new attribute named validateAt which accepts three values. onSubmit (which is the default) performs client-side validation when the form is submitted, just like client-side validation in currently. onBlur performs client-side validation as soon as a field loses focus (user tabs to next field or clicks on another field, for example). onServer performs server-side validation, the same validation that hidden fields perform, but without having to actually define those fields (they are still present, but are generated and embedded automatically). Look at the following code:





And the best part is that validation methods may be mixed. So, to validate on the client and server you could do the following:

Here validateAt is specifying both onSubmit and onServer, and so ColdFusion will both generate client-side validation code, and embed hidden form fields for server-side validation.
Pretty cool stuff.