Best way to prevent HTML Code in Textbox MVC Razor View

Question

I have following code on my view. This HTML code is used for search in website. This view is not strongly typed view, so I can apply use DataAnnotation through model. What is best view to validate that, this textbox should accept only alpha numeric characters?

HTML

<form action="Search" method="post" >
        <div class="col-md-8">
            <input type="text" name="name" placeholder="search" class="fullwidth" onkeypress="return BlockingHtml(this,event);" />
        </div>
        <div class="col-md-4">
            <input type="submit" title="Search" value="Search" />
        </div>
    </form>

Javascript

function BlockingHtml(txt) {
    txt.value = txt.value.replace(/[^a-zA-Z 0-9\n\r.]+/g, '');
}

V2Solutions - MS Team · Accepted Answer · 2014-09-22 07:22:53Z

1

Model:-

[StringLength(100)]
[Display(Description = "Name")]
[RegularExpression("(/[^a-zA-Z 0-9\n\r.]+/g", ErrorMessage = "Enter only alphabets and numbers of Name")]
public string Name{ get; set; }

Updated:-

View:-

 <form action="Search" method="post" >
            <div class="col-md-8">
                <input type="text" name="name" id="txt" placeholder="search" class="fullwidth" onkeypress="BlockingHtml(this);" />
            </div>
            <div class="col-md-4">
                <input type="submit" title="Search" value="Search" />
            </div>
        </form>


function BlockingHtml(txt) {
            txt.value = txt.value.replace(/[^a-zA-Z 0-9\n\r.]+/g, '');
        }

edited Sep 22, 2014 at 7:22

answered Sep 22, 2014 at 6:52

V2Solutions - MS Team

1,1276 silver badges6 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

AK47 Over a year ago

I don't have Model for this view, I have mentioned it in question.

AK47 Over a year ago

Thanks! But if I copy html from somewhere else & paste it in text box, replace is not happening.

V2Solutions - MS Team Over a year ago

Can you post your html

AK47 Over a year ago

If I type <h1> in notepad, copied it & pasted into search text box. After hitting search button, 500 error is there.

AK47 Over a year ago

Got an Idea. just changed event from keypress to onblur.

|

AK47 · Accepted Answer · 2014-10-10 04:06:02Z

0

<form action="Search" method="post" >
        <div class="col-md-8">
            <input type="text" name="name" placeholder="search" class="fullwidth" onblur="return BlockingHtml(this,event);" />
        </div>
        <div class="col-md-4">
            <input type="submit" title="Search" value="Search" />
        </div>
    </form>

Changed event onkeypress to onblur.

answered Oct 10, 2014 at 4:06

AK47

3,8073 gold badges21 silver badges37 bronze badges

Collectives™ on Stack Overflow

Best way to prevent HTML Code in Textbox MVC Razor View

2 Answers 2

6 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

6 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related