how to validate a textbox .

You can use javascript for this. Example:

//Javascript function:
function validate()
{
    var txttext=document.getElementById("TextBox1").value;
    var regex=/[0-9][.][0-9]{2}$/;
    alert(regex.test(txttext));
}

<asp:TextBox ID="TextBox1" runat="server"></asp:TextBox>
<asp:Button ID="Button1" runat="server" Text="Button" OnClientClick="javascript:return validate();"/>

C# Validating TextBox Control[^] should help you get started.

You can use either an ASP.Net validation control or manually create the validation in JavaScript.

Using an ASP.Net Validation Control:

<asp:RegularExpressionValidator runat="server"
   id="DecimalTextBoxValidator"
   ControlToValidate="DecimalTextBoxID"
   ValidationExpression="/^[\d]{1,11}(.[\d]{1,2})?$/"
   ErrorMessage="Number format is invalid."
   EnableClientScript="True" />

The trick to get it to run on the client instead of the server is the EnableClientScript="True" attribute.

For pure JavaScript approaches:

var decimal_regex = /^[\d]{1,11}(.[\d]{1,2})?$/;
function validateDecimal(inputElement){
  return decimal_regex.test(inputElement.value);
}

// In the form validation:
if(validateDecimal(submittedForm['DecimalTextBoxID'])){
  //validation error
}

Or, my personal favorite, add a function to the String prototype and use that in your form validating script:

if(!String.prototype.isDecimal){
  // requires 1 at least digit and 1 decimal digit if separator present
  String.prototype.isDecimal = function(digits, decimals){
    if(digits == undefined){ digits = ""; }
    if(decimals == undefined){ decimals = ""; }
    var regex = new RegExp("^[\\d]{1,"+digits+"}(.[\\d]{1,"+decimals+"})?$");
    return regex.test(this);
  }
}

// In the form validation:
if(!submittedForm['DecimalTextBoxID'].value.isDecimal(11,2)){
  //validation error
}

I would avoid trying to filter input on the text box with javascript (that's a trick and half without a 3rd party library). I would also not do an onBlur/.focus() trap on the box as that tends to frustrate users more than anything else.

Have a look at the RegularExpressionValidator [^] class