Session Variables and Validation Controls

asp.netNOW Q&A

LANGUAGES: VB .NET | C#

TECHNOLOGIES: DataGrids

Session Variables and Validation Controls

Should you use Session Variables in sites with lots ofusers? How can you keep input numeric-only?

By Josef Finsel

Q: Is it a good ideato use Session Variables with ASP.NET and more than 1,000 users?

A: It depends on what you're storing in the sessionvariables and how you define "more than 1,000 users." The problem you're reallygrappling with is the session-less nature of the Internet. Specifically, thereare only two ways to get rid of session data: having it time out or deletingit. If you have a logoff page for your customers, you want to make sure you setthe session variables to nothing to free up the memory. If you don't, thememory won't be freed until the user's session has timed out - by default,that's 20 minutes of inactivity.

Let's take a quick look at the implications this can have.Suppose you have 500 new users every minute and they hang around for fiveminutes or so before they leave. If you don't remove the sessions somehow(having them log off, for example), you're going to end up with memory beingused for a lot more active sessions than really exist. Although you might thinkyou'd have 2,500 active sessions (500 sessions x five minutes), you'd actuallyhave 12,500! Why? Because the first 500 sessions don't drop off until 25minutes into the timeframe (assuming all 500 stop using the service after fiveminutes). And if each session uses 2.5 kb of memory, you'll use 30 mb before halfan hour is up - even though most of those sessions aren't in use.

So, using session variables for active sessions isn't aproblem unless the active sessions aren'treally active. This is one of those cases where you'll have to try it andsee. If your site is big enough, you'll probably need to institute a Web farm,which will spread the session variables across multiple machines and lessenyour worries.

Q: How can I preventnumbers from being entered into a textbox that is supposed to take alphabetic charactersonly?

A: You'll want to use Validation controls to do this.Steven Smith has an in-depth article on validation controls at http://www.aspnetpro.com/features/2002/07/asp200207vd_f/asp200207vd_f.asp,but we'll take a moment to look at the regular expression validator you'd needhere.

The regular expression we will deal with takes this form:^[a-zA-Z0-9 ]+$. The ^ (caret) symbol indicates the beginning of the matchstring, and the $ (dollar sign) represents the end of the string. Anythingwithin the [] (square brackets) is an allowable match. Using "a-z" is ashortcut that reads the set of characters "a" to "z," inclusive. Finally, the +(plus sign) after the [] indicates that the expression may occur any number oftimes. Figure 1 shows this being used in a practical example (you can downloadthe sample application in VB and C#).

Figure 1. Thisform has textboxes with regular expression validators for alphanumeric text,numeric text, and alphanumeric text without spaces.

In this form, you have three textboxes labeledtxtAlphaNumeric, txtNumeric, and txtAlpha; you also have aRegularExpressionValidator after each textbox. There are three properties ofthe RegularExpressionValidator that need to be filled in: ControlToValidate,ErrorMessage, and ValidationExpression. When the control in any of thesetextboxes loses focus, the validator compares the data in the textbox with theregular expression in the ValidationExpression property. For example, in thetxtNumeric TextBox, you want it only to contain numeric data, soValidationExpression is set to "^[0-9]+$" and the ErrorMessage property is setto "Must be Numeric only."

You can learn more about regular expressions at http://www.aspnetpro.com/features/2002/09/asp200209ss_f/assp200209ss_f.asp.

Have a question? Send it to [email protected].

The files referenced in this article are available fordownload.

Josef Finsel is asoftware consultant with G.A. Sullivan, specializing in .NET and SQL Server. Hehas published a number of VB, .NET, and SQL Server-related articles, and, whenhe isn't hanging around the aspnetPRO forums, you can find him working on thesyntax for FizzBin.NET - a programming language that works the way programmershave always suspected. He's also author of TheHandbook for Reluctant Database Administrators (Apress).