title: Validation for Form and QueryString in ASP Classic using Regex. Almost working but missing something?
body: <p>I'm trying to add some Input Validation in Classic ASP by using the function/code seen below.
  The only one that looks like it's working correctly is the "text" type. the others I keep getting errors or it just does not filter correctly.
  I'm trying to understand what I'm doing wrong please help me.</p>
  
  <p>Valid Data Types: "email", "integer", "date", "string" and "text". 
  The first three are obvious, the last two have slight differences.</p>
  
  <p>The "<strong>email</strong>" should only allow numbers and leters, and the following characters "<strong>@</strong>" , "<strong>-</strong>" , "<strong>.</strong>" , "<strong>_</strong>"</p>
  
  <p>The "<strong>date</strong>" should validate by running IsDate and if True then allow if False DON'T.</p>
  
  <p>The "<strong>string</strong>" should validate text-based querystrings, allowing only letters, numbers, _, - and . </p>
  
  <p>Whereas "<strong>text</strong>" is any free-form text form field type content.</p>
  
  <p>The "<strong>integer</strong>" should only allow numbers and a period (.)</p>
  
  <p><em><strong>Usage Example:</em></strong> <code>&lt;input type="text" value="&lt;%=MakeSafe("test@test.com&lt;/HTML&gt;1234.5",integer,50)%&gt;"&gt;</code></p>
  
  <p><em><strong>Eg:</em></strong> <code>MakeSafe(dataInput,dataType,dataLength)</code></p>
  
  <pre><code>&lt;%
  '// CODE BY: dB Masters
  '// FOUND AT: http://successontheweb.blogspot.com/2008/03/input-validation-for-security-in.html
  
  Function MakeSafeConvert(encodeData)
  encodeData = replace(encodeData,"&amp;", "&amp;#38;")
  encodeData = replace(encodeData,"'", "&amp;#39;")
  encodeData = replace(encodeData,"""", "&amp;quot;")
  encodeData = replace(encodeData,"&gt;", "&amp;gt;")
  encodeData = replace(encodeData,"&lt;", "&amp;lt;")
  encodeData = replace(encodeData,")", "&amp;#41;")
  encodeData = replace(encodeData,"(", "&amp;#40;")
  encodeData = replace(encodeData,"]", "&amp;#93;")
  encodeData = replace(encodeData,"[", "&amp;#91;")
  encodeData = replace(encodeData,"}", "&amp;#125;")
  encodeData = replace(encodeData,"{", "&amp;#123;")
  encodeData = replace(encodeData,"--", "&amp;#45;&amp;#45;")
  encodeData = replace(encodeData,"=", "&amp;#61;")
  MakeSafeConvert = encodeData
  End Function
  
  Function MakeSafe(dataInput,dataType,dataLength)
  
  Dim regex, validInput, expressionmatch
  regex = ""
  validInput = "1"
  
  If dataType = "string" And Len(dataInput) &gt; 0 Then
      regex = "^[\w-\.]{1,"&amp; dataLength &amp;"}$"
  ElseIf dataType = "email" And Len(dataInput) &gt; 0 Then
      regex = "^[\w-\.]+@([\w-]+\.)+[\w-]{2,6}$"
  ElseIf dataType = "integer" And Len(dataInput) &gt; 0 Then
      regex = "^\d{1,"&amp; dataLength &amp;"}$"
  ElseIf dataType = "date" And Len(dataInput) &gt; 0 Then
  If Not IsDate(dataInput) Then validInput = "0" End If
  ElseIf dataType = "text" And Len(dataInput) &gt; 0 Then
  If Len(dataInput) &gt; dataLength Then validInput = "0" End If
  End If
  
  If Len(regex) &gt; 0 And Len(dataInput) &gt; 0 Then
      Set RegExpObj = New RegExp
      RegExpObj.Pattern = regex
      RegExpObj.IgnoreCase = True
      RegExpObj.Global = True
      RegExpChk = RegExpObj.Test(dataInput)
  
  If Not RegExpChk Then
      validInput = "0"
      End If
      Set RegExpObj = nothing
  End If
  
  If validInput = "1" And Len(dataInput) &gt; 0 Then
      MakeSafe = MakeSafeConvert(dataInput)
      ElseIf Len(dataInput) = 0 Then
      MakeSafe = ""
  Else
      Response.Write "&lt;h2&gt;Processing Halted.&lt;/h2&gt;"
      Response.End
  End If
  
  End Function
  %&gt;
  </code></pre>
  
  <p><strong>EXAMPLE CODE AND ERROR(S):</strong> </p>
  
  <p>When I test this using the code: </p>
  
  <p><strong>&lt;%=MakeSafe("test@test.com1234.5",email,50)%></strong> 
  <em>*</em> Does NOT Validate Anything.*
  <BR><BR><BR></p>
  
  <p>I don't get an error message but it DOES NOT Validate anything.</p>
  
  <p>**The OUTPUT IS : test@test.com1/27/20121234.5</p>
  
  <p>SHOULD BE ONLY: test@test.com**</p>
  
  <p>When I test this using the code:</p>
  
  <p><strong>&lt;%=MakeSafe("test@test.com1/27/20121234.5",date,50)%></strong> </p>
  
  <p>I don't get an error message but it DOES NOT Validate anything.</p>
  
  <p>The OUTPUT IS : test@test.com1/27/20121234.5
  SHOULD BE ONLY: 1/27/2012</p>
  
  <p>The other two give me this error message: </p>
  
  <p><strong>&lt;%=MakeSafe("test@test.com1234.5",string,50)%></strong><br>
  <em>*</em> ERROR!!! Wrong number of arguments or invalid property assignment: 'string'</p>
  
  <p><strong>&lt;%=MakeSafe("test@test.com1234.5",integer,50)%></strong> </p>
  
  <p><em>*</em> ERROR!!! Syntax error</p>
  
  <p>Thank you so much for any help that you provide...</p>