Validating user's input format is not working

Question

Validating user's input format is not working

Simflex 326

Our requirement is to ask users to create a password with the following format:

First letter of firstname+First letter of lastname+2 digits of month+2 digits of day+4 digits of year.

For instance, a user with the name of John Doe, born January 1, 1900 will have the format of JD01011900.

Any input not in this format generates an error to the user letting him/her know input is invalid...

The following code is not working in the sense that when I intentionally enter wrong date format like JD01012300, we expect an error message shown to the user that the input format is incorrect,

However, no error is getting displayed.

Instead, whatever input the user entered goes through as valid.

Can someone please help with why this is not working?

Entire code is below:

Imports System
Imports System.Text.RegularExpressions

    Protected Sub txtdob_TextChanged(sender As Object, e As EventArgs) Handles txtdob.TextChanged

        Dim input As String = txtdob.Text

        Dim isValid As Boolean = Validator.ValidateString(input)

        If String.IsNullOrEmpty(txtdob.Text.Trim()) Then

              emplabel.ForeColor = System.Drawing.Color.Red

            emplabel.Text = "Empid is required!"

            Me.txtdob.Focus()

        ElseIf Not isValid Then

            emplabel.ForeColor = System.Drawing.Color.Red

            emplabel.Text = "Invalid format. Example John Doe, JD02262025"

            Me.txtdob.Focus()

        End If

        

    Public Class Validator

        Public Shared Function ValidateString(ByVal input As String) As Boolean

            If input.Length <> 10 Then Return False

            Dim pattern As String = "^[A-Za-z]{2}\d{8}$"

            If Not Regex.IsMatch(input, pattern) Then Return False

            Dim datePart As String = input.Substring(2, 8)

            Dim dateValue As DateTime

            If Not DateTime.TryParseExact(datePart, "MMddyyyy", Nothing, System.Globalization.DateTimeStyles.None, dateValue) Then

                Return False

            End If

            Return True

        End Function

    End Class

    

    HTML:

    <asp:TextBox ID="txtdob" maxlength="10" placeholder="Enter Combination..." Style="width: 250px;" class="form-control"

    runat="server" AutoPostBack="true" OnTextChanged="txtdob_TextChanged">

AgaveJoe 1,510 Reputation points

2025-02-18T23:57:18.69+00:00

So anyone that know the name and birthdate of your application users also knows their password? That's not good.
Simflex 326 Reputation points

2025-02-19T00:05:22.3633333+00:00

I agree with you sir but not my call. They said it will be used for internal uses and for a limited time.
SurferOnWww 4,951 Reputation points

2025-02-19T01:06:18.94+00:00

Please edit your question to make your code readable:
Albert Kallal 5,591 Reputation points

2025-02-19T01:11:16.8266667+00:00

But how is the sample of JD01012300 incorrect? That means John Doe, and born on January 1st, and the year 2300. Based on your requirements, that looks to be valid. (unless you have some place on the form where they are to enter their birth date). But then again, if you ask them their birthdate in a text box elsewhere on the form?

Then, you can generate the password for them, right? Regardless, I don't see how that "supposed" date format is incorrect unless we missing the part about where the user's date was entering some place else on the form. And, that being the case, then you can create the password for them, right? So from what you given, how and way is that sample BD incorrect? (and how would you know???).
Viorel 125.6K Reputation points

2025-02-19T01:18:42.61+00:00

“JD01012300” is actually valid. Did you try invalid values like “JD31022300”?
Simflex 326 Reputation points

2025-02-19T01:41:22.8033333+00:00

Please allow me to try to respond to each of your questions starting with SurferOnWww.

I tried editing and switching the button to allow markup to display correctly. I am not sure I succeeded.

Albert and Viorel, That was my bad. I was trying to display HOW the format should be.

For instance, after the invalid message, I wanted to say the format should be like this... Then example. Sorry about the confusion.
Simflex 326 Reputation points

2025-02-19T02:07:29.9333333+00:00

By the way, how is JD01012300 valid?

That's January 1st, 2300.
SurferOnWww 4,951 Reputation points

2025-02-19T03:25:22.98+00:00

Is your app ASP.NET Web Forms? If so, why don't you use the CustomValidator control?
AgaveJoe 1,510 Reputation points

2025-02-19T11:35:23.5333333+00:00

I agree with you sir but not my call. They said it will be used for internal uses and for a limited time.

So "they" signed-off on all internal users to know each other's password.

The next major issue with this design, if I understand the requirement, is application must know the user's name and birthdate before the user creates the password.

It is not clear how user register for this internal application. I'll assume all internal users have an account that contains their name (first and last) as well as their birthdate.

The validation logic has to somehow lookup the user. I assume the username is unique and can be used to find the user's account Next, build the password from the user account information and compare the database generated password with the password string submitted by the user. If the two string match then save the password. Keep in mind, at this point the user has technically authenticated.

If the user account does not exist before creating the password then the best you can do to validate the password is accept a password string that starts with two alpha characters followed by to digits that must be between 01 and 12 inclusive, two digits between 01 and 31 inclusive, four digits between maybe 1950 and this year minus 16. The next step is try parsing the date part into an actual C# DateTime which will let you know if the date is valid. Or, thinking about this more, you could TryParse the date portion of the password string. If the date is valid then check the bounds of the date. For example, you don't to allow a 150 year old or a 1 year old to authenticate.

3 answers

Your answer

AgaveJoe 1,510 Reputation points

2025-02-18T23:57:18.69+00:00

So anyone that know the name and birthdate of your application users also knows their password? That's not good.
Simflex 326 Reputation points

2025-02-19T00:05:22.3633333+00:00

I agree with you sir but not my call. They said it will be used for internal uses and for a limited time.
SurferOnWww 4,951 Reputation points

2025-02-19T01:06:18.94+00:00

Please edit your question to make your code readable:
Albert Kallal 5,591 Reputation points

2025-02-19T01:11:16.8266667+00:00

But how is the sample of JD01012300 incorrect? That means John Doe, and born on January 1st, and the year 2300. Based on your requirements, that looks to be valid. (unless you have some place on the form where they are to enter their birth date). But then again, if you ask them their birthdate in a text box elsewhere on the form?

Then, you can generate the password for them, right? Regardless, I don't see how that "supposed" date format is incorrect unless we missing the part about where the user's date was entering some place else on the form. And, that being the case, then you can create the password for them, right? So from what you given, how and way is that sample BD incorrect? (and how would you know???).
Viorel 125.6K Reputation points

2025-02-19T01:18:42.61+00:00

“JD01012300” is actually valid. Did you try invalid values like “JD31022300”?
Simflex 326 Reputation points

2025-02-19T01:41:22.8033333+00:00

Please allow me to try to respond to each of your questions starting with SurferOnWww.

I tried editing and switching the button to allow markup to display correctly. I am not sure I succeeded.

Albert and Viorel, That was my bad. I was trying to display HOW the format should be.

For instance, after the invalid message, I wanted to say the format should be like this... Then example. Sorry about the confusion.
Simflex 326 Reputation points

2025-02-19T02:07:29.9333333+00:00

By the way, how is JD01012300 valid?

That's January 1st, 2300.
SurferOnWww 4,951 Reputation points

2025-02-19T03:25:22.98+00:00

Is your app ASP.NET Web Forms? If so, why don't you use the CustomValidator control?
AgaveJoe 1,510 Reputation points

2025-02-19T11:35:23.5333333+00:00

I agree with you sir but not my call. They said it will be used for internal uses and for a limited time.

So "they" signed-off on all internal users to know each other's password.

The next major issue with this design, if I understand the requirement, is application must know the user's name and birthdate before the user creates the password.

It is not clear how user register for this internal application. I'll assume all internal users have an account that contains their name (first and last) as well as their birthdate.

The validation logic has to somehow lookup the user. I assume the username is unique and can be used to find the user's account Next, build the password from the user account information and compare the database generated password with the password string submitted by the user. If the two string match then save the password. Keep in mind, at this point the user has technically authenticated.

If the user account does not exist before creating the password then the best you can do to validate the password is accept a password string that starts with two alpha characters followed by to digits that must be between 01 and 12 inclusive, two digits between 01 and 31 inclusive, four digits between maybe 1950 and this year minus 16. The next step is try parsing the date part into an actual C# DateTime which will let you know if the date is valid. Or, thinking about this more, you could TryParse the date portion of the password string. If the date is valid then check the bounds of the date. For example, you don't to allow a 150 year old or a 1 year old to authenticate.

Answer 1

Hi Simflex,

Sorry for the late answer. I tried recreating this problem but I found that your code largely works fine (aside from Sub txtdob_TextChanged missing End Sub) and TryParseExact can already handle dates properly. In your case maybe you want to make sure the date doesn't exceed a certain threshold (such as birthday couldn't be later than current date)? then I would just add a check like:

dateValue > DateTime.Today

Here's my recreation:

.aspx:

<%@ Page Language="vb" AutoEventWireup="false" CodeBehind="Default.aspx.vb" Inherits="PasswordFormatValidator._Default" %>
 
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title>Password Format Validator</title>
<link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css" rel="stylesheet" />
</head>
<body>
<form id="form1" runat="server" class="container mt-5">
<div class="mb-3">
<label for="txtdob" class="form-label">Enter password (e.g., JD01011900):</label>
<asp:TextBox ID="txtdob" runat="server" CssClass="form-control" MaxLength="10"
                Placeholder="First letter of first + last name + MMDDYYYY"
                AutoPostBack="true" OnTextChanged="txtdob_TextChanged" />
</div>
<asp:Label ID="emplabel" runat="server" CssClass="form-text"></asp:Label>
</form>
</body>
</html>

aspx.vb:

Imports System.Text.RegularExpressions
 
Public Class _Default
    Inherits System.Web.UI.Page
 
    Protected Sub txtdob_TextChanged(sender As Object, e As EventArgs) Handles txtdob.TextChanged
        Dim input As String = txtdob.Text.Trim()
 
        If String.IsNullOrEmpty(input) Then
            emplabel.ForeColor = Drawing.Color.Red
            emplabel.Text = "Empid is required!"
            txtdob.Focus()
            Return
        End If
 
        Dim isValid As Boolean = Validator.ValidateString(input)
 
        If Not isValid Then
            emplabel.ForeColor = Drawing.Color.Red
            emplabel.Text = "Invalid format. Example John Doe, JD02262025"
            txtdob.Focus()
        Else
            emplabel.ForeColor = Drawing.Color.Green
            emplabel.Text = "Valid format!"
        End If
    End Sub
 
    Public Class Validator
        Public Shared Function ValidateString(ByVal input As String) As Boolean
            ' Check format: 2 letters followed by 8 digits
            If input.Length <> 10 Then Return False
 
            Dim pattern As String = "^[A-Za-z]{2}\d{8}$"
            If Not Regex.IsMatch(input, pattern) Then Return False
 
            ' Validate date portion (MMDDYYYY)
            Dim datePart As String = input.Substring(2, 8)
            Dim dateValue As DateTime
            If Not DateTime.TryParseExact(datePart, "MMddyyyy", Nothing, Globalization.DateTimeStyles.None, dateValue) Then
                Return False
            End If
 
            ' Date must not be in the future
            If dateValue > DateTime.Today Then
                Return False
            End If
 
            Return True
        End Function
 
    End Class
End Class

Hope I interpreted this correctly. Please tell me if you have any issues.

Danny Nguyen (WICLOUD CORPORATION) 5,065 Reputation points Microsoft External Staff Moderator

2025-07-28T02:18:45.02+00:00

Hi, was wondering if my solution is of any help
Danny Nguyen (WICLOUD CORPORATION) 5,065 Reputation points Microsoft External Staff Moderator

2025-08-07T10:33:40.5733333+00:00

Just checking in — I haven’t heard back from you for a while, I hope everything works out as you expected. I understand things can get busy or priorities may shift.

If you’re still experiencing the issue or need further support, feel free to jump back in at any time — I will always be here and happy to help.

Wishing you all the best with your work!

Answer 2

Jiachen Li-MSFT 34,231 Microsoft External Staff

Hi @Simflex ,

Uses DateTime.TryParseExact with "dd/MM/yyyy" to check if the date is valid (e.g., rejects 31/04/2024 or 29/02/2025 as 2025 is not a leap year).

    Function IsValidInput(ByVal input As String) As Boolean
        Dim pattern As String = "^[A-Z]{2}(\d{2})(\d{2})(\d{4})$"
        Dim match As Match = Regex.Match(input, pattern)

        If match.Success Then
            Dim day As Integer = Integer.Parse(match.Groups(1).Value)
            Dim month As Integer = Integer.Parse(match.Groups(2).Value)
            Dim year As Integer = Integer.Parse(match.Groups(3).Value)

            ' Validate the date
            Dim dateString As String = $"{day:D2}/{month:D2}/{year:D4}"
            Dim parsedDate As DateTime

            If DateTime.TryParseExact(dateString, "dd/MM/yyyy", CultureInfo.InvariantCulture, DateTimeStyles.None, parsedDate) Then
                Return True
            End If
        End If

        Return False
    End Function

Best Regards.

Jiachen Li

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Simflex 326 Reputation points

2025-02-19T01:45:47.4633333+00:00
@jiachen li , thank you for your quick code. We would like the format to me 01/01/1900. In other words, we would like to be Month followed by Day, followed by Year.

Besides, I think our code is failing here:

ElseIf Not isValid Then emplabel.ForeColor = System.Drawing.Color.Red emplabel.Text = "Invalid format. Example John Doe, JD02262025" Me.txtdob.Focus()

I hope I am wrong. You guys are the experts.

Thanks to all of you who have taken your valuable time to respond.

Jiachen Li-MSFT 34,231 Microsoft External Staff

Hi @Simflex ,

Swap the position of the month and day in the code, and then add a validation that the date is no later than DateTime.Today.

    Function IsValidInput(ByVal input As String) As Boolean
        Dim pattern As String = "^[A-Z]{2}(\d{2})(\d{2})(\d{4})$"
        Dim match As Match = Regex.Match(input, pattern)

        If match.Success Then
            Dim month As Integer = Integer.Parse(match.Groups(1).Value)
            Dim day As Integer = Integer.Parse(match.Groups(2).Value)
            Dim year As Integer = Integer.Parse(match.Groups(3).Value)

            Dim dateString As String = $"{month:D2}/{day:D2}/{year:D4}"
            Dim parsedDate As DateTime

            If DateTime.TryParseExact(dateString, "MM/dd/yyyy", CultureInfo.InvariantCulture, DateTimeStyles.None, parsedDate) Then
                ' Ensure date is not later than today
                If parsedDate <= DateTime.Today Then
                    Return True
                End If
            End If
        End If

        Return False
    End Function

Jiachen Li-MSFT 34,231 Reputation points Microsoft External Staff

2025-02-20T07:03:11.1533333+00:00

Hi @Simflex ,

May I know if you have got any chance to check my answer? I am glad to help if you have any other questions.

Answer 3

I understand that your app is the ASP.NET Web Forms. If so, I suggest that you use the RequiredFieldValidator, RegularExpressionValidator and CustomValidator as follows:

.aspx.cs

using System;
using System.Web.UI;
using System.Web.UI.WebControls;

namespace WebForms1
{
	public partial class WebForm55 : System.Web.UI.Page
	{
		protected void Page_Load(object sender, EventArgs e)
		{

		}        

        protected void CustomValidator1_ServerValidate(object source, 
                                        ServerValidateEventArgs args)
        {
            var datePart = args.Value.Substring(2, 8);
            DateTime dateValue;
            if (DateTime.TryParseExact(datePart, "MMddyyyy", null, 
                    System.Globalization.DateTimeStyles.None, 
                    out dateValue))
            {
                args.IsValid = true;
            }
            else
            {
                args.IsValid = false;
            }
        }

        protected void Button1_Click(object sender, EventArgs e)
        {
            if (Page.IsValid)
            {
                // do something
            }
        }
    }
}

.aspx

<%@ Page Language="C#" AutoEventWireup="true"
    CodeBehind="WebForm55.aspx.cs"
    Inherits="WebForms1.WebForm55" %>

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
    <title></title>
    <style type="text/css">
        .style1 {
            display: none;
        }
    </style>
    <script type="text/javascript">
        // AutoPostBack of TextBox does not work properly with the
        // validators. Button must be clicked to postback. The following
        // script click the hidden Button at the change event of TextBox.
        let textBox, btn;
        window.addEventListener('DOMContentLoaded', () => {
            textBox = document.getElementById('<%=txtdod.ClientID%>');
            btn = document.getElementById('<%=Button1.ClientID%>');
            textBox.addEventListener("change", () => {
                btn.click();
            });
        });
    </script>
</head>
<body>
    <form id="form1" runat="server">
        <asp:TextBox
            ID="txtdod"
            MaxLength="10"
            placeholder="Enter Combination..."
            Style="width: 250px;"
            runat="server">
        </asp:TextBox>

        <asp:RequiredFieldValidator
            ID="RequiredFieldValidator1"
            runat="server"
            ErrorMessage="Empid is required!"
            ControlToValidate="txtdod"
            Display="Dynamic"
            ForeColor="Red">
        </asp:RequiredFieldValidator>

        <asp:RegularExpressionValidator
            ID="RegularExpressionValidator1"
            runat="server"
            ErrorMessage="Invalid format. Example John Doe, JD02262025"
            ControlToValidate="txtdod"
            Display="Dynamic"
            ValidationExpression="^[A-Za-z]{2}\d{8}$"
            ForeColor="Red">
        </asp:RegularExpressionValidator>

        <asp:CustomValidator ID="CustomValidator1"
            runat="server"
            ErrorMessage="Invalid date"
            Display="Dynamic"
            ControlToValidate="txtdod"
            OnServerValidate="CustomValidator1_ServerValidate"
            ForeColor="Red">
        </asp:CustomValidator>
        <br />

        <%--hidden button--%>
        <asp:Button ID="Button1"
            runat="server"
            Text="Button"
            OnClick="Button1_Click" 
            CssClass="style1" />
    </form>
</body>
</html>

Result of validation by CustomValidator:

enter image description here

Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Simflex 326 Reputation points

2025-02-20T00:30:43.4133333+00:00

@SurferOnWww , first, very sorry for late response.

I just got back from offsite conference that lasted all day; was originally set to last till 1pm Est.

Anyway, I have ran your code as many times and from different combinations as I could possibly run it but regardless of what data I entered, including the one you used in your example, I don't get any errors.

I know you made a reference to AutoPostBacks not working properly with validators and that's why you added the button1 click and event listener.

What about text_Exchanged event?

In the code I posted, we use text_exchanged event method to check the DB for the existence of the EmpID being referenced.

If the EmPID exists on our DB, then it is retrieved and along with other values and populate the form.

If it doesn't exist, that's when these validations of first two letters plus 8 digit month, day and year are enforced.

I guess my question is whether the text_exchanged event handler is interfering with the code you wrote?

Thank you so much for your help, sir.
SurferOnWww 4,951 Reputation points

2025-02-20T07:59:44.0933333+00:00

What about text_Exchanged event?

It does not work properly with the validators.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Share via

Validating user's input format is not working

3 answers

Your answer