Add server-side form validation to the order form in the bookstore case study. Check that the credit-card expiration date is after today’s date. If not, redirect the user to error.py with the message "Expired credit card." Also, make all fields in the form required fields. When the user does not supply data for all required fields, redirect the user back to order.py.

Question

What will be an ideal response?

Answer 1

```
# Exercise 23.6: process.py
# Display thank you page to customer and delete session

import cgi
import time
import sys
import Session

# load session
try:
session = Session.Session()
except Session.SessionError, message: # invalid/no session ID
Session.redirect( "error.py?message=%s" % message )
sys.exit()

form = cgi.FieldStorage()
fields = [ "firstname", "lastname", "city", "state", "creditcard",
"zipcode", "phone", "street", "expires", "expires2" ]

# test for required fields
for field in fields:

if not form.has_key( field ):
Session.redirect( "order.py?ID=%s" % session.data[ "ID" ] )
sys.exit()

# test for expired credit card
month = int( time.strftime( "%m" ) )
year = int( time.strftime( "%Y" ) )
cardMonth = int( form[ "expires" ].value )
cardYear = int( form[ "expires2" ].value )

if ( cardYear < year ) or ( ( cardYear == year ) and \
( cardMonth <= month ) ):
Session.redirect( "error.py?message=Expired+credit+card." )
sys.exit()

# display content type and thankYou for specific client-type
content = open( "%s/thankYou.%s" % ( session.data[ "agent" ],
session.data[ "extension" ] ) )
pageData = session.data[ "content type" ] + content.read() % \
session.data[ "total" ]
content.close()

# delete session and display thank you page
session.deleteSession()
print pageData
```