ColdFusion lets you specify form field validation on the server by using hidden form fields whose names consist of the name of the field to validate and the validation type. Hidden field validation uses the same underlying techniques and algorithms as onServer validation of ColdFusion form fields.

Hidden field validation has the following features:

• You can use it with standard HTML tags. For example, you can validate data in an HTML input tag. This feature was particularly useful in releases prior to ColdFusion MX 7, because the cfinput tag did not support all HTML type attributes.
• It is backward-compatible with validation prior to ColdFusion MX 7, when hidden field validation was the only way to do validation on the server.
• Because you use a separate tag for each validation type, if you specify multiple validation rules for a field, you can specify a different error message for each rule.
• You can use hidden field validation with any form field type that submits a data value, not just input, cfinput, textarea, or cftextarea.

Specifying hidden form field validation

To specify hidden field validation, you do the following:

• Create one HTML input element or CFML cfinput tag of type="hidden" for each validation rule.
• Specify the name of the field to validate as the first part of the hidden field name.
• Specify the type of validation, starting with an underscore character (_), as the second part of the hidden field name.
• You can specify multiple rules for each form data field. For example, to specify range and required validation for a field named myValue, create hidden myValue_cfformrange and myValue_cfformrequired fields.
• For most types of validation, specify the error message as the field value attribute.
• For range, maximum length, or regular expression validation, specify the rule, such as the maximum length, in the value attribute. For these validation types, you cannot specify a custom error message.

The following example uses hidden fields to require data in a date field and ensure that the field contains a date. It consists only of HTML tags.

<input type="text" name="StartDate" size="16" maxlength="16"><br>
<input type="hidden" name="StartDate_required" 
        value="You must enter a start date.">
<input type="hidden" name="StartDate_date" 
    value="Please enter a valid date as the start date.">

Use the following suffixes at the end of hidden form field names to specify the validation type. The type identifier always starts with an underscore. Several validation rules have two names you can use. The names that do not start with "_cf" were used in earlier releases and are retained for backward compatibility. For consistency and clarity, Adobe recommends using the names that start with "_cf" in new forms.

Hidden form field considerations

Consider the following rules and recommendations when determining whether and how to use hidden form field validation:

• Use hidden field validation if you want to validate data from standard HTML input tags. The cfinput and cftextarea tags include a validateAt attribute that provides a simpler method for specifying server-side validation.
• Consider using hidden field validation with the cfinput and cftextarea tags if you specify multiple validation rules for a single field and want to provide a separate error message for each validation.
• Do not use the suffixes listed in the table as field names.
• Adding a validation rule to a field does not make it a required field. You must add a separate _required hidden field to ensure user entry.

Hidden form field example

The following procedure creates a simple form for entering a start date and a salary. It uses hidden fields to ensure that you enter data and that the data is in the right format.

This example uses a self-submitting form; the same ColdFusion page is both the form page and its action page. The page uses an IsDefined function to check that form data has been submitted. This way, the pages does not show any results until you submit the input. The form uses HTML tags only; you can substitute these tags with the CFML equivalents.

<html>
<head>
    <title>Simple Data Form</title>
</head>
<body>
<h2>Simple Data Form</h2>

<!--- Form part. --->
<form action="datatest.cfm" method="Post">
    <input type="hidden" 
        name="StartDate_cfformrequired" 
        value="You must enter a start date.">
    <input type="hidden" 
        name="StartDate_cfformdate" 
        value="Enter a valid date as the start date.">
    <input type="hidden" 
        name="Salary_cfformrequired" 
        value="You must enter a salary.">
    <input type="hidden" 
        name="Salary_cfformfloat" 
        value="The salary must be a number.">
    Start Date: 
    <input type="text" 
        name="StartDate" size="16" 
        maxlength="16"><br>
    Salary: 
    <input type="text" 
        name="Salary" 
        size="10" 
        maxlength="10"><br>
    <input type="reset" 
        name="ResetForm" 
        value="Clear Form">
    <input type="submit" 
        name="SubmitForm" 
        value="Insert Data">
</form>
<br>

<!--- Action part. --->
<cfif isdefined("Form.StartDate")>
    <cfoutput>
        Start Date is: #DateFormat(Form.StartDate)#<br>
        Salary is: #DollarFormat(Form.Salary)#
    </cfoutput>
</cfif>
</html>

When the user submits this form, ColdFusion scans the form fields to find any validation rules. It then uses the rules to analyze the user's input. If any of the input rules are violated, ColdFusion displays an error page with the error message that you specified in the hidden field's value attribute. The user must go back to the form, correct the problem, and resubmit the form. ColdFusion does not accept form submission until the user enters the entire form correctly.

Because numeric values often contain commas and currency symbols, ColdFusion automatically deletes these characters from fields with _cfforminteger and _cfformfloat rules before it validates the form field and passes the data to the form's action page. ColdFusion does not delete these characters from fields with _cfformnumeric rules.

Reviewing the code

The following table describes the code and its function: