When and why do you use TryUpdateModel in asp.net mvc 2?

Question

I can't seem to find just a sample of the base code to see how TryUpdateModel works? When do you use it and why?

Answer 1

This method can be used to update a model that supports a specific view through this controller. For example, if I have a view displaying a Foo object with a property bar filled with a text box, I can call the Save () method on the controller and call TryUpdateModel to try to update Foo.

public class Foo { public string Bar { get; set; } } // ... in the controller public ActionResult Save() { var myFoo = new Foo(); TryUpdateModel(myFoo); } 

This will try to update the model with the given value for Bar. If the update does not pass the check (say, for example, that the Bar was an integer, and the text field had the text “hello” in it), then TryUpdateModel will transmit the ViewData ModelState update with verification errors, and verification errors will be displayed on your view.

Be sure to pay attention to the security warning for the .NET Framework 4 in the MSDN documentation:

Safety note . Use one of the [Overload: System.Web.Mvc.Controller.TryUpdateModel``1] methods that take either a property list to include (whitelist) or a property list to exclude (a blacklist). If there is an explicit whitelist or blacklist, the [Overload: System.Web.Mvc.Controller.TryUpdateModel`1] method attempts to update each publication property in the model for which the corresponding value in the request is. An attacker could use this to update properties that you are not going to grant access to.

https://msdn.microsoft.com/en-us/library/system.web.mvc.controller.tryupdatemodel(v=vs.100).aspx

Answer 2

TryUpdateModel() allows you to bind parameters to your model inside your action. This is useful if you want to load your model from the database and then update it based on user input, rather than deriving the entire model from user input.

 public ActionResult Update(int id) { var service = new ServiceClass(); var record = service.LoadModel(id); if (!TryUpdateModel(record)) { // There was an error binding data return View(); } // Everything was ok, now save the record back to the database service.SaveModel(record); return View("Success"); } 

In this regard, it acts similarly to UpdateModel() , but returns true if successful and false if there is an error. UpdateModel() throws an exception if there is an error that requires a bit more code.

Note. You might want to use one of the overloads, which allows you to limit which properties can be updated.

Answer 3

We also used TryUpdateModel to avoid model binding magic before the action was called; instead, we took HttpFormCollection as our parameter and named TryUpdateModel inside the method. The pure boolean value returned from this allowed control flow is passed to the Success or Failure method for the action. eg.

 public ActionResult Save(HttpFormCollection formCollection) { var saveModel = new SaveModel(); // or from a Factory etc var validModel = TryUpdateModel(_saveModel, formCollection); // order may be incorrect return validModel ? Save(saveModel) : InvalidSaveModel(saveModel); } 

It was pretty easy for us to build an HttpFormCollection for all of our validation cases and therefore validate the action.