ASP.NET

Confirm message boxes in ASP.NET: OnClientClick and confirmations decided on the server

ASP.NET · By the Postback Notes editorial team · Published 2026-08-27

The browser's confirm() dialog returns true or false. Returning that value from a button's client-side click handler is enough to cancel a postback when the user clicks Cancel. The more delicate case is when the server must decide whether to ask, for example "this customer has open orders, delete anyway?".

ASP.NET Button markup with an OnClientClick confirm that cancels the postback
A confirm dialog in OnClientClick.

Confirm before posting back

<asp:Button ID="btnDelete" runat="server" Text="Delete account"
    OnClick="btnDelete_Click"
    OnClientClick="return confirm('Delete this account? This cannot be undone.');" />

ASP.NET renders onclick="return confirm(…);" before its own postback code. If the user cancels, the function returns false and the submit stops. With UseSubmitBehavior="false" or a LinkButton, the same pattern works because ASP.NET appends its __doPostBack call after your script.

Watch out for client-side validators: returning true explicitly would skip ASP.NET's validation script in some configurations. Write if (!confirm('…')) return false; rather than return confirm('…'); when validators share the button.

Message set from code-behind

protected void Page_Load(object sender, EventArgs e)
{
    string msg = "Delete the account of " + CurrentCustomer.Name + "?";
    btnDelete.OnClientClick = "if (!confirm(" + HttpUtility.JavaScriptStringEncode(msg, true) + ")) return false;";
}

Encoding the message prevents a name containing quotes from breaking the script, or worse.

In GridView rows

<asp:TemplateField>
    <ItemTemplate>
        <asp:LinkButton runat="server" CommandName="Delete" Text="Delete"
            OnClientClick='<%# "if (!confirm(" + HttpUtility.JavaScriptStringEncode("Delete " + Eval("Name") + "?", true) + ")) return false;" %>' />
    </ItemTemplate>
</asp:TemplateField>

Add <%@ Import Namespace="System.Web" %> if HttpUtility is not recognised in the markup.

When the server decides whether to ask

Sometimes the need to confirm is only known after checking the database. Use two steps: the first postback checks, and if confirmation is needed, the page shows a question; a second button performs the action.

<asp:Button ID="btnDelete" runat="server" Text="Delete customer" OnClick="btnDelete_Click" />
<asp:Panel ID="pnlConfirm" runat="server" Visible="false" CssClass="confirm" role="alertdialog" aria-labelledby="confirmText">
    <p id="confirmText"><asp:Literal ID="litConfirm" runat="server" Mode="Encode" /></p>
    <asp:Button ID="btnConfirmDelete" runat="server" Text="Yes, delete" OnClick="btnConfirmDelete_Click" />
    <asp:Button ID="btnCancel" runat="server" Text="Cancel" OnClick="btnCancel_Click" />
</asp:Panel>
protected void btnDelete_Click(object sender, EventArgs e)
{
    int open = OrderRepository.CountOpen(CustomerId);
    if (open == 0) { DeleteCustomer(); return; }
    litConfirm.Text = $"This customer has {open} open order(s). Delete anyway?";
    pnlConfirm.Visible = true;
}

protected void btnConfirmDelete_Click(object sender, EventArgs e)
{
    DeleteCustomer();          // re-check permissions here: this is a separate request
    pnlConfirm.Visible = false;
}

protected void btnCancel_Click(object sender, EventArgs e) => pnlConfirm.Visible = false;

This approach needs no script, works with keyboard and screen readers, and keeps the decision on the server. A <dialog> element or a modal from your UI library can present the panel more attractively.

Showing a simple information message is covered in Show an alert from code-behind.

Official documentation