Last updated: August 26, 2026.
Read submitted values from Request.Form, validate them on the server, and encode values before returning them to HTML.
Form and processing page
<form method="post" action="process.asp">
<label>Email <input type="email" name="email" required maxlength="254"></label>
<button type="submit">Submit</button>
</form>
<%
Dim email
email = Trim(Request.Form("email"))
If Len(email) = 0 Or Len(email) > 254 Or InStr(2, email, "@") = 0 Then
Response.Status = "400 Bad Request"
Response.Write "Invalid email address."
Response.End
End If
Response.Write "Received: " & Server.HTMLEncode(email)
%>Browser validation improves usability but does not replace server validation. Use parameterized ADO commands for database writes and add CSRF protection to state-changing forms.
