<form method="post" action="{{ url('/add_movie') }}">
   Title: <input type="text" name="title">
   <br>

   Genre: <select name="genre">

            <option value="1">Action</option>

            <option value="2">Comedy</option>

            <option value="3">Horror</option>

          </select>
   <br>

   Year: <input type="text" name="year">
   <br>
   <input type="submit" value="Save">
   <br>
</form>

1. (3 pts) What command would you add to the routes file in order to pass this form request to a function named addMovie controller called MovieController?
2. (6 pts) Write the addMovie function in the controller so that it validates the form. If any of the validations fail it should return to the original form. Otherwise it should write “Success!” to the error log. Validations to perform: title must exist and have no more than 200 characters; genre must exist and be 1, 2, or 3; year must exist and contain exactly 4 digits.

3. (6 pts) Show how you would modify the HTML code given above so that if validation fails, it will repopulate the form data for the user. Write your answer on the exam sheet to show your modifications rather than re-writing the entire form.

4. (2 pts) What changes would you need to make in order to provide CSRF protection for the “add movie” action described here.

5. (6 pts) Suppose you are creating a page that will display all movie data. Further suppose that the movie data has been passed to the view from the controller in a variable named movies. Further suppose that this variable is an array of objects with each object having this form:

   {
      title: "Men in Black",
      genre: 2,
      year: 2010
   }
   

   Assuming the view is handled by a blade template file, show how you would display all movie data to the page while preventing XSS attacks. To format the data, just put the title, genre (no need to translate the number to to a string), and year together on a line separated by a space. Each line should have only one movie.

Suppose you are working on a web application built using the NodeJS framework that allows users to enter data about movies. Further suppose that the page that allows entry of a new movie currently looks like this:

<form method="post" action="/add_movie">
   Title: <input type="text" name="title">
   <br>

   Genre: <select name="genre">

            <option value="1">Action</option>

            <option value="2">Comedy</option>

            <option value="3">Horror</option>

          </select>
   <br>

   Year: <input type="text" name="year">
   <br>
   <input type="submit" value="Save">
   <br>
</form>

1. (6 pts) Write an addMovie controller function in the controller that will reside in a file named: controllers/movie.js. In the controller add code to validate the form. If any of the validations fail it should return to the original form and pass to the form data (via the session) to it. Otherwise it should write “Success!” to the console log. Validations to perform: title must exist and have no more than 200 characters; genre must exist and be 1, 2, or 3; year must exist and contain exactly 4 digits.

2. (4 pts) Assuming the addMovie function you created above is the first function to be written in controllers/movie.js, what commands would you add to the routes file in order to pass the form request to that function?

3. (6 pts) Show how you would modify the HTML code given above so that if validation fails, it will repopulate the form data for the user. Write your answer on the exam sheet to show your modifications rather than re-writing the entire form. You should assume the view is using the EJS templating format.

4. (6 pts) Suppose you are creating a page that will display all movie data. Further suppose that the movie data has been passed to the view from the controller in a variable named movies. Further suppose that this variable is an array of objects with each object having this form:

   {
      title: "Men in Black",
      genre: 2,
      year: 2010
   }
   

   Assuming the view is handled by an EJS template file, show how you would display all movie data to the page while preventing XSS attacks. Use the same formatting as in the previous problem.