I can't turn off Request Validation for an ASP.NET MVC Controller

Question

I am trying to turn off Request Validation for all action methods in a controller by doing this:

[ValidateInput(false)]
public class MyController : Controller
{
    ...

The reference I am using says this is possible and tells me to do it this way, but for some reason it's not working.

If I submit any html (even a simple <b> tag) through a text box, I get the error:

A potentially dangerous Request.Form value was detected from the client (text=<b>").

It's also not working by attaching the attribute to an individual method.

How can I disable Request Validation for a controller?

EDIT

I am working in VS2008 built in test server.

Based on all the stuff that's not working, you'll have to provide a lot more detail. Are you running in IIS, or Cassini? You are running MVC v1.0, right? What is the method signature of the action that is failing? — GalacticCowboy
– GalacticCowboy, Commented Jul 10, 2009 at 17:25
I love when I find someone asking the exact question I have- only to see that it is closed for not being applicable to other visitors. FML. — Kelly Robins
– Kelly Robins, Commented Apr 29, 2013 at 18:58

Robert Harvey · Accepted Answer · 2009-07-10 16:48:35Z

17

I tested it on my machine, on both the class definition and the action method, and it worked for me in both cases. Are you sure your view lines up with your method/controller? Are you putting the attribute on the GET method or the POST method?

[AcceptVerbs(HttpVerbs.Post)]
[ValidateInput(false)]   
public ActionResult MyAction (int id, string content) {   
    // ...   
}

edited Jul 10, 2009 at 16:48

answered Jul 10, 2009 at 16:07

Robert Harvey

182k48 gold badges349 silver badges516 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

Ronnie Overby Over a year ago

In the original question, I stated that I did that. And my reference, Apress Pro ASP.NET MVC Framework, clearly states, "If you want to disable it either for a specific action method or across a specific controller, you can use the [ValidateInput] filter, as follows: [ValidateInput(false)] public class MyController : Controller { ... }"

Robert Harvey Over a year ago

See stackoverflow.com/questions/807662/…

Robert Harvey Over a year ago

Sorry, Ronnie. It works on my machine, whether I put the attribute on the method or the class.

Ronnie Overby Over a year ago

I have tried on the controller and the action. I know the view lines up with the action method, because I have only 1 view and 1 controller. I have done a complete build and rebuild. I don't understand why this will not work!

Robert Harvey Over a year ago

So there is something systemically wrong. Consider creating a new project with a simple controller and view, and test again. There is a counterpart in plain ASP.NET that can be tested also. Did you stumble across this post? stackoverflow.com/questions/1038102/…

|

the_joric · Accepted Answer · 2011-01-13 23:18:27Z

13

To make it working you need to modify web.config as well:

<system.web>
    <httpRuntime requestValidationMode="2.0"/>
    ...
</system.web>

answered Jan 13, 2011 at 23:18

the_joric

12.3k6 gold badges39 silver badges58 bronze badges

1 Comment

Nick Bork Over a year ago

I had an ASP.NET MVC 1.0 project deployed in production for over a year, tonight the client sends me an email telling me that one of the forms that uses a WYSIWYG editor wont submit. I've had [ValidateInput(false)] on the action for as long as the site has been deployed and it worked fine up until recently. The hosting provider must have changed something on their end. I added the httpRuntime tag to the system.web as Jan suggested and it fixed my issue.

Stefan Steiger · Accepted Answer · 2011-06-13 11:05:38Z

3

Pro ASP.NET MVC Framework (p466) says the following is supposed to work:

public class MyController : Controller 
{
     public MyController() {
        ValidateRequest = false;
     }
}

edited Jun 13, 2011 at 11:05

Stefan Steiger

83.1k70 gold badges405 silver badges461 bronze badges

answered Jul 10, 2009 at 16:37

keithm

2,8133 gold badges31 silver badges38 bronze badges

2 Comments

Robert Harvey Over a year ago

It doesn't intellisense or compile there. I tried putting it into the action method (where it does intellisense), but it didn't work.

keithm Over a year ago

"ValidateRequest = false;" is supposed to be in the constructor. I I had tried it on one of my controllers but transcribed it wrong.

Tony Borf · Accepted Answer · 2009-07-10 18:25:27Z

Can you post your controller file and your view file.

This works;

MytestController--------------------------------

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Mvc;
using System.Web.Mvc.Ajax;

namespace testapp.Controllers
{
    [ValidateInput(false)]
    public class MyTestController : Controller
    {

        public ActionResult Index()
        {
            return View();
        }

    }
}

MyTest(Index)-------------------------------------------------------

<%@ Page Language="C#" Inherits="System.Web.Mvc.ViewPage" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title>Index</title>
</head>
<body>
 <% using (Html.BeginForm()) { %>
 <%= Html.TextBox("test")%>
 <button type="submit"  >Submit</button>
 <%} %>
</body>
</html>

Collectives™ on Stack Overflow

I can't turn off Request Validation for an ASP.NET MVC Controller

EDIT

4 Answers 4

8 Comments

1 Comment

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

EDIT

4 Answers 4

8 Comments

1 Comment

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related