java 44 lines · 9 steps

Customizing form binding in a Spring MVC controller

An @InitBinder method cleans and constrains request parameters before they populate a command object, then a POST handler validates and saves it.

Explained by highlit

Spring Intermediate data-binding validation type-conversion security mvc

1@Controller
2@RequestMapping("/employees")
3public class EmployeeController {
4 
  private final EmployeeService employeeService;
6 
  public EmployeeController(EmployeeService employeeService) {
      this.employeeService = employeeService;
  }
10 
  @InitBinder
  public void initBinder(WebDataBinder binder) {
      binder.registerCustomEditor(String.class, new StringTrimmerEditor(true));
14 
      SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd");
      dateFormat.setLenient(false);
      binder.registerCustomEditor(Date.class, new CustomDateEditor(dateFormat, true));
18 
      binder.registerCustomEditor(BigDecimal.class, new CustomNumberEditor(BigDecimal.class, true) {
          @Override
          public void setAsText(String text) {
              if (text == null || text.isBlank()) {
                  setValue(null);
                  return;
              }
              String normalized = text.trim().replace(",", "").replace("$", "");
              setValue(new BigDecimal(normalized).setScale(2, RoundingMode.HALF_UP));
          }
      });
30 
      binder.setDisallowedFields("id", "createdAt");
  }
33 
  @PostMapping
  public String create(@Valid @ModelAttribute("employee") Employee employee,
                       BindingResult result, RedirectAttributes redirectAttributes) {
      if (result.hasErrors()) {
          return "employees/form";
      }
      Employee saved = employeeService.create(employee);
      redirectAttributes.addFlashAttribute("message", "Employee created");
      return "redirect:/employees/" + saved.getId();
  }
44}

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1@InitBinder lets you register per-controller editors that transform raw request strings before they reach your model.
2Blocking sensitive fields with setDisallowedFields defends against mass-assignment attacks where users forge unexpected parameters.
3Pairing @Valid with a BindingResult keeps validation errors on the form instead of throwing, preserving user input.

Related explainers

php

<?php
 
namespace App\Services\Checkout;

Validating coupons with Laravel's Pipeline

pipeline chain of responsibility transactions

Intermediate 7 steps

java

@Component
@Converter
public class EncryptedStringConverter implements AttributeConverter<String, String> {

Transparent column encryption in Spring & JPA

encryption aes-gcm jpa-converter

Advanced 10 steps

php

<?php
 
namespace App\Services;

How a password strength validator works in PHP

validation regular-expressions data-driven

Intermediate 8 steps

java

package com.acme.billing.config;
 
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.context.properties.ConfigurationProperties;

Feature-flagged beans with Spring @ConditionalOnProperty

feature-flags conditional-beans strategy-pattern

Intermediate 5 steps

rust

use chrono::{Duration, NaiveDate};
 
#[derive(Debug)]
pub struct DateRange {

Parsing and iterating date ranges in Rust

error-handling iterators parsing

Intermediate 7 steps

java

public static Map<String, String> parseCookieHeader(String header) {
    Map<String, String> cookies = new LinkedHashMap<>();
    if (header == null || header.isBlank()) {
        return cookies;