Model Binding & Validation

1. Binding Sources: Where Data Comes From

Request: POST /product/create with form data Name=Phone&Price=999

[HttpPost]
public IActionResult Create(ProductCreateViewModel vm)
{
    // vm.Name = "Phone" ← auto-filled from form
    // vm.Price = 999 ← auto-filled + converted to decimal
}

Order: 1. Form values 2. Route values 3. Query string 4. Body. First match wins.

2. Explicit Binding Attributes

Rule: MVC defaults to Form. API with [ApiController] defaults to Body.

3. Validation: Data Annotations

public class ProductCreateViewModel
{
    [Required(ErrorMessage = "Name required")]
    [StringLength(100, MinimumLength = 3)]
    public string Name { get; set; }

    [Range(1, 10000)]
    public decimal Price { get; set; }

    [EmailAddress]
    public string ContactEmail { get; set; }
}

Controller check:

[HttpPost]
public IActionResult Create(ProductCreateViewModel vm)
{
    if (!ModelState.IsValid)
    {
        return View(vm); // Returns to form with errors
    }
    // Save to DB
    return RedirectToAction("Index");
}

4. Show Errors in View

<form asp-action="Create">
    <div asp-validation-summary="All" class="text-danger"></div>

    <input asp-for="Name" class="form-control" />
    <span asp-validation-for="Name" class="text-danger"></span>

    <input asp-for="Price" class="form-control" />
    <span asp-validation-for="Price" class="text-danger"></span>

    <button type="submit">Save</button>
</form>

asp-validation-for shows error for one field. asp-validation-summary shows all.

1. Value Providers: Binding Pipeline

ASP.NET checks providers in order for each parameter:

1. FormValueProvider: Request.Form["Name"]
2. RouteValueProvider: RouteData.Values["id"]
3. QueryStringValueProvider: Request.Query["page"]
4. JsonBodyValueProvider: Deserializes JSON body

What is a Value Provider? Component that reads data from one source. You can write custom ones.

2. Complex Model Binding: Nested Objects

public class ProductCreateViewModel
{
    public string Name { get; set; }
    public AddressViewModel ShippingAddress { get; set; }
}

public class AddressViewModel
{
    public string Street { get; set; }
    public string City { get; set; }
}

HTML:

<input name="Name" value="Phone" />
<input name="ShippingAddress.Street" value="MG Road" />
<input name="ShippingAddress.City" value="Pune" />

Binder uses dot notation. ShippingAddress.Street → vm.ShippingAddress.Street

3. Collection Binding

Post multiple items:

<input name="Tags[0]" value="Electronics" />
<input name="Tags[1]" value="Mobile" />

public IActionResult Create(List<string> Tags)
{
    // Tags = ["Electronics", "Mobile"]
}

Index must start at 0 and be sequential. Skip 1 → binding stops.

4. Custom Validation: IValidatableObject

For rules that need multiple fields:

public class EventViewModel : IValidatableObject
{
    public DateTime StartDate { get; set; }
    public DateTime EndDate { get; set; }

    public IEnumerable<ValidationResult> Validate(ValidationContext context)
    {
        if (EndDate < StartDate)
        {
            yield return new ValidationResult(
                "End date must be after start date",
                new[] { nameof(EndDate) });
        }
    }
}

Runs after Data Annotations. If you yield error, ModelState.IsValid = false.

5. [Bind] and [BindNever]: Security

Prevent overposting by whitelisting fields:

[HttpPost]
public IActionResult Create([Bind("Name,Price")] Product product)
{
    // Even if form posts IsAdmin=true, it's ignored
}

Or on model:

public class Product
{
    public string Name { get; set; }

    [BindNever] // Binder skips this
    public bool IsAdmin { get; set; }
}

Better: Use separate Input ViewModel. Don't bind Entity.

6. [ApiController] Changes Behavior