ASP.NET MVC Controller return view model clarification

Question

The following are two examples of a controller for submitting data. One returns the input model if validation fails the other doesn't. Can someone enlighten me on which is method correct or preferred? They seem to behave exactly the same.

With returning model

    [HttpPost]
    public ActionResult Register(RegisterModel model)
    {
        if (ModelState.IsValid)
        {
    //do stuff
        }


        return View(model);
    }

Without returning model

    [HttpPost]
    public ActionResult Register(RegisterModel model)
    {
        if (ModelState.IsValid)
        {
    //do stuff
        }


        return View();
    }

Bernhard Kircher · Accepted Answer · 2012-07-14 09:59:17Z

2

Usually you want the user to show an error message if the data he submitted is not valid (e.g. he did not enter a valid email address into a field that requries to be an email - see MVC ModelValidation for more information).

You use the ModelState.IsValid to check for that. In this case you usually show him the page he came from ("Register") and you also want to show the data he entered into the form fields (= RegisterModel). But you want to display an errormessage that tells him what fields are not correct.

If the user's data is correct and your action succeeds (in this case he was registered successfully) you usually do not show him the registration form again, but you would redirect him to a success page.

Here is a simple example how to validate, show errors and redirect after successfull action.

Example from your code:

[HttpPost]
public ActionResult Register(RegisterModel model)
{
    if (ModelState.IsValid)
    {
       //do stuff
       // redirect to a success page
       return RedirectToAction("Success");
    }

    // data is not valid - show the user his data and error messages
    // using Html Helper methods (see link for details)
    return View(model);
}

On the Register view (Ifno - if you have a strongly typed view, you can use the HTML Helper overloads for that - e.g. use Html.LabelFor, TextboxFor etc methods):

Show general error message/summary;

...
<%= Html.ValidationSummary("Register was not successfull") %>

Show error message next to the inputs:

...
<%= Html.TextBox("Email") %>
<%= Html.ValidationMessage("Email", "*") %>

edited Jul 14, 2012 at 9:59

answered Jul 14, 2012 at 9:52

Bernhard Kircher

4,2023 gold badges35 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

James Over a year ago

'model' is an user submitted input, can we trust it? what if there's a malicious string in there and since it failed ModelState.IsValid, is it safe the display? that's way i posted this question.

Bernhard Kircher Over a year ago

never trust user input. ModelState.IsValid does not check if the userinput contains sql injection attacks or something like that. It just validates if the datatypes are correct (e.g. is userinput a number for an int property and so on) and other validation (using the attributes etc.), e.g. format validation, min-max values etc. If you are going to process the data further, you have to make sure that you use the data safely (html encode, use parametrized sql etc). ModelState.Isvalid can't check this, because it does not know what you are going to do with the data.

Vlad Bezden Over a year ago

In your example you call return View(model); however same effect will be if you call return View(); The link that you provided uses return View() technique. The question is how View will get model and present valid error information and present that data back in case if return View(); is called?

Jakub Konecki · Accepted Answer · 2012-07-14 09:46:36Z

0

Will you view render without model passed to it? Probably not, so the second one will fail.

I would suggest you read about Post Redirect Get pattern

http://en.wikipedia.org/wiki/Post/Redirect/Get

answered Jul 14, 2012 at 9:46

Jakub Konecki

46.1k8 gold badges92 silver badges128 bronze badges

Comments

HatSoft · Accepted Answer · 2012-07-14 09:54:49Z

0

The first action at the end is passing the Model to the view and the second one your returning back an empty view. So I would suggest you go for the first one

But when validation fails you should do the error handling this way

if (ModelState.IsValid)
        {
    //do stuff
        }
   else
   {
      ModelState.AddModelError("RegisterModel Errors", "some error occured");
   } 

       return View(model);

answered Jul 14, 2012 at 9:54

HatSoft

11.3k3 gold badges30 silver badges43 bronze badges

Comments

Prashanth Thurairatnam · Accepted Answer · 2012-07-14 10:45:44Z

0

Since you have a strongly typed view, in either case you will need to pass the corresponding model to the view (else your view may crash on trying to access properties on a null model). On success you can redirect to another page or you should be able to give user a notification, in the same page itself updating whether the operation is a success or fail (depends on whether you want a usual HTML based solution or an AJAX enabled solution). As for validation there are the options of usual client side validation and the jQuery based unobtrusive client side validation.

Here are couple of useful links

ASP.NET Model validation (this is MVC2 based but should be same for MVC3)

MVC3 unobtrusive client validation

answered Jul 14, 2012 at 10:45

Prashanth Thurairatnam

4,3592 gold badges17 silver badges17 bronze badges

Collectives™ on Stack Overflow

ASP.NET MVC Controller return view model clarification

4 Answers 4

3 Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

3 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related