ASP Web Pages Forms

How it works

IsPost distinguishes a POST request from a first page visit. AntiForgery.GetHtml emits a token field and cookie; AntiForgery.Validate verifies the matching pair. Anti-forgery validation does not identify or authorise a user. This local form accepts a narrow quantity and only displays it; it does not write a booking.

Use the separate Windows lab

This is a legacy-maintenance course. Classic ASP uses IIS and VBScript; ASP.NET Web Pages uses .NET Framework and Razor. Neither runs in PHP, Apache or Bhylu’s browser playground. The reviewed baseline is 32-bit IIS Express 10.0.2001, .NET Framework 4.8, Web Pages / Razor 3.2.9 and the Windows VBScript engine. ADO database examples use the actual 32-bit Jet OLE DB 4.0 provider, not SQL Server or XAMPP MySQL.

Download download-lab.mjs into a separate empty learning folder. Run node download-lab.mjs to fetch hash-checked source files into a new bhylu-asp-lab folder, then cd bhylu-asp-lab and node run-lab.mjs --start. Before deployment, local preview uses node download-lab.mjs http://127.0.0.1:8000/examples/asp/. The source downloader refuses an existing destination. Review its source before running it.

The foreground launcher needs your own 32-bit IIS Express installation with Classic ASP, .NET Framework 4.8 and the VBScript engine available. It downloads the three pinned Web Pages packages from NuGet into its private cache, binds only localhost on port 8142 and stops when you press Ctrl+C. Keep its console open. Visit http://localhost:8142/webpages-forms.cshtml. It does not install IIS, enable Windows features, change Apache/PHP/MySQL, or publish any files. See the bundled README.txt for manual setup and test boundaries.

Each complete Classic ASP source requires the supplied Global.asa acknowledgement; Web Pages uses _PageStart.cshtml. Database and file examples create owned temporary files only under this private lab’s blocked App_Data folder. Sources are public text downloads; do not upload them as executable teaching endpoints on Bhylu.

Download webpages-forms.cshtml

Example

@using System.Web.Helpers
@{
    Layout = null;
    string result = "Choose 1, 2 or 3";
    if (IsPost) {
        try { AntiForgery.Validate(); }
        catch (System.Web.Mvc.HttpAntiForgeryException) { Response.StatusCode = 400; Response.Write("Token refused"); Response.End(); }
        var values = Request.Form.GetValues("quantity");
        if (values == null || values.Length != 1 || (values[0] != "1" && values[0] != "2" && values[0] != "3")) {
            Response.StatusCode = 400; result = "Invalid quantity";
        } else { result = "Requested: " + values[0]; }
    }
}
<form method="post">@AntiForgery.GetHtml()<label>Quantity <input name="quantity" value="1" /></label><button>Check</button></form>
<p id="result">@result</p>

@using System.Web.Helpers
@{
    Layout = null;
    string result = "Choose 1, 2 or 3";
    if (IsPost) {
        try { AntiForgery.Validate(); }
        catch (System.Web.Mvc.HttpAntiForgeryException) { Response.StatusCode = 400; Response.Write("Token refused"); Response.End(); }
        var values = Request.Form.GetValues("quantity");
        if (values == null || values.Length != 1 || (values[0] != "1" && values[0] != "2" && values[0] != "3")) {
            Response.StatusCode = 400; result = "Invalid quantity";
        } else { result = "Requested: " + values[0]; }
    }
}
<form method="post">@AntiForgery.GetHtml()<label>Quantity <input name="quantity" value="1" /></label><button>Check</button></form>
<p id="result">@result</p>

Expected result

Choose 1, 2 or 3

The reviewer loads the actual generated form, retains its cookie and submits its token. It also tests a missing token and duplicated quantity. HTTP loopback is used only for the private lab; production cookie/TLS policy needs a separate deployment review.

Primary references

• Microsoft Classic ASP configuration
• Microsoft Web Pages documentation
• Microsoft ADO API reference