How can I prevent empty strings being used to bypass mandatory fields?

[Sabrina10]

I have UI Policies that set fields as Mandatory. A user can type in a single space, which will then fulfill the Mandatory check at the client level and change the bar from red to green. The user can then save the request without error, but the database converts the empty string to a null value. This then makes the field Mandatory again, so when they open the request again, the field is empty and the red bar is there.

This is causing us a problem because users are entering in a space for a required field on the Change form and then advancing it to the next stage in the process. The next person to get the request then opens the Change and sees that required fields are missing. Its happening for string and date fields (why someone would enter a change without a date is beyond me, but they found a way to do it).


Has anyone come across this problem and have a solution for it? I was thinking of trying to write Business Rules to check for empty values, but I'd really hate to have business rules and UI Policies doing the same thing.

[Mark Stanger]

Sounds like somebody needs a good slap on the wrist! It sounds like part of your issue needs to be addressed by process/policy within your organization. The other part can (and should) be addressed by the tool. The problem with using client scripts and UI policies to force mandatory fields is that people can bypass them in this way. They can also bypass them through other methods as well like list editing. Because of this, if it really needs to be mandatory everywhere you need to use server-side techniques to force that those fields be mandatory. This article explains a server-side technique that allows you to do this.

http://www.servicenowguru.com/scripting/stopping-record-submission-servicenow/

[CapaJC]

I'll echo Mark in that unless people doing that are appropriately abused/deterred, protecting against a blank space will merely cause them to have to type an "a" in each field instead.

[Sabrina10]

Thanks for the replies. I completely agree that it has to be addressed at the process level, but I wanted to post the question here to be sure I wasn't missing something overly obvious about required fields. I definitely don't want to get into writing business rules to to duplicate all of the UI Policies.