Validate select boxes

[feck]

Do you have to validate selection boxes when validating a form?, seeing as the values entered are restricted too values already placed within the options.If so, could you give me a few pointers in the right direction as to validating these types of inputs.

[jesh]

I typically only validate selects that I deem as required by checking to see if the selected index is greater than a default.If your select was:

<select id="myselect">  <option value="-1">Select an Option</option>  <option value="1">Value 1</option>  <option value="2">Value 2</option></select>

You could validate that like so:

var select = document.getElementById("myselect");if(select.selectedIndex > 0){	// it validates}

Or you can validate by value:

var select = document.getElementById("myselect");if(select.options[select.selectedIndex].value != "-1"){	// it validates}

[feck]

thanks jesh,what i'm wondering is say for instance that your putting things into a database, that are preset values like names for instance.You have only four names to choose from do you need to validate these?My question arises because of something I've read about called Javascript Injection whereby a user could actually put in a value to be submitted that is not in the actual selct box.

[aspnetguy]

thanks jesh,what i'm wondering is say for instance that your putting things into a database, that are preset values like names for instance.You have only four names to choose from do you need to validate these?My question arises because of something I've read about called Javascript Injection whereby a user could actually put in a value to be submitted that is not in the actual selct box.

Could you post the link to that article it would be a good read for everyone.

[feck]

Here's one I read again todayJavascript Injection Although it does'nt mention anything about select boxes I'm sure the same process applies.

[Webworldx]

Ideally you want to be validating all fields server side, the javascript bits are just for end-user experience - so they don't have to keep submitting the form and getting it returned with errors