ASP.NET - ASP.NET (VB Version) check if Zip Code exists. If not, show a message : Code Entry

Live Editing Disabled for Server-Side Example

HTML

<%@ Page Language="VB" ValidateRequest="False" AutoEventWireup="false" CodeFile="Load.aspx.vb" Inherits="Load" %>

<!DOCTYPE html>

<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
    <title></title>
</head>
<body>
    <form id="form1" runat="server">
        <div>
            <asp:TextBox ID="Zip" runat="server"></asp:TextBox>
            <asp:Button ID="Sub" runat="server" Text="Button" />
        </div>
        <asp:Panel ID="ShowZip" runat="server">
            Zip Code: <asp:Label ID="Zipcode" runat="server"></asp:Label><br />
            City = <asp:Label ID="City" runat="server"></asp:Label><br />
            State = <asp:Label ID="State" runat="server"></asp:Label><br />
            County = <asp:Label ID="County" runat="server"></asp:Label><br />
        </asp:Panel>
    </form>
</body>
</html>

ASP.NET

<?xml version="1.0"?>
<configuration>
  <connectionStrings configSource="database.config" />
  <system.web>
    <compilation debug="true" strict="false" explicit="true" targetFramework="4.7.2" />
    <httpRuntime targetFramework="4.7.2" requestValidationMode="2.0" />
  </system.web>

<?xml version="1.0"?>
<connectionStrings>
  <add name ="Virtual-Learning" connectionString="Data Source=sqlcorecs-01\sql2019;Database=Virtual-Class-01;User ID=testuser;Password=testuser;MultipleActiveResultSets=True"/>
</connectionStrings>

Imports System.Data.SqlClient

Partial Class Load
    Inherits System.Web.UI.Page


    Protected Sub Page_Load(sender As Object, e As EventArgs) Handles Me.Load
        ShowZip.Visible = False

    End Sub
    Private Function ProtectXSS(ByVal SqlString As String) As String
        SqlString = Replace(SqlString, "'", "'") ' replace single Quotes with Double Quotes
        SqlString = Replace(SqlString, ">", ">") ' replace > with >
        SqlString = Replace(SqlString, "<", "<") ' replace < with <
        SqlString = Replace(SqlString, "(", "(") ' replace ( with (
        SqlString = Replace(SqlString, ")", ")") ' replace ) with )
        SqlString = Trim(SqlString)
        ProtectXSS = SqlString
    End Function
    Protected Sub Sub_Click(sender As Object, e As EventArgs) Handles <sub>.Click
        Dim LessonCon As New SqlConnection
        Dim LessonCMD As SqlCommand = Nothing
        Dim ZC As String = ProtectXSS(Zip.Text)
        'Response.Write(ZC)
        'Response.End()
        LessonCon = New SqlConnection(ConfigurationManager.ConnectionStrings("Virtual-Learning").ConnectionString)
        LessonCon.Open()

        If Not IsNumeric(ZC) Then
            Response.Write(ZC & "Not a valid number, please enter a Zip Code.")
        Else
            Dim getZip As New SqlCommand("select Zip, City, State, County from ZipTable where Zip=@Zip", LessonCon)
            getZip.Parameters.Add(New SqlParameter("@Zip", ZC))
            Dim rsZip As SqlDataReader
            rsZip = getZip.ExecuteReader()
            If rsZip.Read() Then
                ShowZip.Visible = True
                Zipcode.Text = rsZip("Zip")
                City.Text = rsZip("City")
                State.Text = rsZip("State")
                County.Text = rsZip("County")
            Else

                Try
                    LessonCMD.ExecuteNonQuery()
                Catch ex As Exception
                    Response.Write("Sorry, there seems to be an issue. Please try entering the Zip Code the proper way and try again.")
                Finally
                    rsZip.Close()
                    LessonCon.Close()
                End Try

            End If

        End If
    End Sub
End Class

Preview