topic Re: VALIDATION? in Application Development and Automation Discussions

VALIDATION?

Former Member — Wed, 05 Sep 2007 10:30:56 GMT

HI all,

I have a input field P_MATNR is a select-option.

If user enters a material in selection-screen...i need to check weather the material is there(mara) or not....if he enters a wrong material..i have to give a message.

vkr.

Re: VALIDATION?

Former Member — Wed, 05 Sep 2007 10:35:18 GMT

hi,

there are two options.

1 either give p_matnr type mara-matnr.

so that you will get a help directly for selecting the material number directly from the data base table.

2 is use at-selection screen .

select single matnr from mara where matnr = p_matnr .

if sy-subrc not equal to zero

message 'invalid aterial number' type 'E'.

end if.

Re: VALIDATION?

Former Member — Wed, 05 Sep 2007 10:35:48 GMT

AT SELECTION-SCREEN ON P_MATNR.

SELECT MATNR FROM MARA INTO W_MATNR

UP TO 1 ROWS WHERE MATNR EQ P_MATNR.

ENDSELECT.

IF SY-SUBRC NE 0.

CLEAR SSCRFIELDS-UCOMM.

MESSAGE 'Invalid Material'.

ENDIF.

Regards,

Pavan

Re: VALIDATION?

Former Member — Wed, 05 Sep 2007 10:36:38 GMT

Hi,

At selection-screen.

select single matnr into wa_matnr

from mara

where matnr in p_matnr.

if sy-subrc <> 0 .

message e000 with 'Invalid Material numebr'.

end if.

Satya.

Re: VALIDATION?

Former Member — Wed, 05 Sep 2007 10:37:03 GMT

Is no-one paying any attention to the fact that P_MATNR is a select-option.

Re: VALIDATION?

Former Member — Wed, 05 Sep 2007 10:37:12 GMT

Hi,

Refer to the following code:

at selection-screen.

SELECT SINGLE * FROM MSEG WHERE

MBLNR = IMBLNR.

IF SY-SUBRC <> 0.

MESSAGE S000(ZMM) WITH 'Please select a valid Material Number'.

ENDIF.

Hope this helps.

Reward if helpful.

Regards,

Sipra

Re: VALIDATION?

Former Member — Wed, 05 Sep 2007 10:37:21 GMT

hi,

try like this,

select single matnr from mara where matnr = p_matnr .

if sy-subrc not equal to zero

message 'invalid material number' type 'E'.

end if.

if helpful reward some points.

with regards,

Suresh Aluri.

Re: VALIDATION?

former_member404244 — Wed, 05 Sep 2007 10:37:56 GMT

Hi,

u can validate at atslection screen event.

at-selection screen .

select single matnr from mara where matnr = p_matnr .

if sy-subrc ne 0.

message '<invalid material number' >

endif.

Regards,

Nagaraj

Re: VALIDATION?

Former Member — Wed, 05 Sep 2007 10:41:41 GMT

HERE IS SOME SAMPLE CODE..

AT SELECTION-SCREEN.

IF P_MATNR-LOW = ''.

MESSAGE E000(YMSG).

ELSEIF P_MATNR -HIGH = ''.

MESSAGE E000(YMSG).

ENDIF.

Re: VALIDATION?

Former Member — Wed, 05 Sep 2007 10:47:20 GMT

Hi VKR,

<b>Input Validation</b>

Description

Whenever software processes input, it should make sure that this input is in the expected form. From a functional point of view, this will ensure a high data quality level. From a security point of view, this will prevent unexpected data from altering the intended execution of the program.

Software processes input from various sources:

● User input from a GUI

● Parameters from a configuration file

● Data from a database

● Data from remote function calls

● And so on

If input is not sufficiently validated, the application processing the data might crash or could be tricked into performing unwanted tasks.

What Do I Need to Do?

Basically, you should validate your input. To achieve that goal, you have to provide a validation function for each input variable. You might group the variables (for example, all input strings) and write one validation function for each group (for example, string validator), which increases your efficiency. The task of writing validation code can be described as a step-wise procedure. In the case of Web Dynpro, the framework automatically performs the type validation before you can even access a variable. So the first three steps of the following list have been already performed. Consequently, in Web Dynpro you only have to start your additional input validation at the fourth step of the following input validation ‘to do’ list:

...

1. Existence and length check

2. Canonicalization

3. Type check

4. Range check

5. White list filter

6. Black list filter

These steps are explained in more detail below:

Step 1: Existence and length check

It must not be possible to attack the application simply by omitting a necessary variable or feeding in data packets that are either too long or too short. So, first of all, your validation function needs to check if the variable of interest exists and has the correct length.

Step 2: Canonicalization

Canonicalization means that the input variable’s content is transformed into its simplest and shortest representation. Many attack methods depend on the usage of ‘polymorph representation’, that is, an unusual or overly complicated form that is designed to evade filter mechanisms. So the transformation into its simplest form is fundamental for successful filter mechanisms.

Step 3: Type check

Since attackers should not be able to harm the application by feeding input data of the wrong type to it (such as strings instead of dates), the validation function needs to check that the variable is of the correct type.

Step 4: Range check

After that, you should check if the variable's values are in the correct range. Clearly, this is only possible for variables with a definable range of values (like numbers). It is imperative that you define the limits exactly here. You should consider where the boundaries lie for all input.

Step 5: ‘White list’ filter

If a variable simply has no clear range of values (for example, strings), a range check would be pointless. In this case, your validation function should contain a list of allowed values and check the input against this instance. Such an instance is called a ‘white list’ filter.

Step 6: ‘Black list’ filter

There may be cases where you cannot even implement a white list filter. In this situation, you should at least write a black list filter function: this is better than doing no filtering at all. Doing nothing here regularly has detrimental effects for the security of your application.

<b>Validation using field exits</b>

If for a particular transaction you want the error message (any validation checks) and it should not allow further processing of that transaction, then its the time to go for FIELD EXIT. Steps: 1. Create a Function Group. 2. Run the program RSMODPRF, which will create a field exit (Mention the data element for which field exit is needed). 3. In the Function module created by the above program write the validation code you require.

Regards,

Kumar.

Re: VALIDATION?

Former Member — Wed, 05 Sep 2007 10:48:53 GMT

i am sorry i didnt check for select options

for select options if low is 1000 and high is 2000 then

select matnr from mara into table gt_mara where matnr in p_matnr.

here in this table you will get all the existing material numbers from mara in gt_mar between 1000 and 2000

I guess individually slecting based on select options is difficult.

Re: VALIDATION?

Former Member — Wed, 05 Sep 2007 10:54:50 GMT

Just add VALUE CHECK.

Ex.


PARAMETERS: p_matnr LIKE mara-matnr VALUE CHECK.

But if you're dealing with select options. Your p_matnr should be s_matnr. Then code it like this:


AT SELECTION-SCREEN ON S_MATNR.
  IF NOT S_MATNR[] IS INITIAL.
    SELECT MATNR
       FROM MARA
       INTO MARA-MATNR
       UP TO 1 ROWS
       WHERE MATNR IN S_MATNR.
    ENDSELECT.

    IF SY-SUBRC NE 0.
      MESSAGE .... WITH 'Invalid Material Number'.
    ENDIF.

  ENDIF.