MVC c# prevent xss

Question

I have a simple email form on my site with mvc c#.

If i added into the text box alert("test") I get the below exception:

A potentially dangerous Request.Form value was detected from the client (Message="<script>alert("test"...").

I dont want a user to be able to insert javascript. I need for html encode i would i do this on this field

 @Html.TextAreaFor(model => model.Message, new { @style = "width:800px;height:300px;" })

possible duplicate of A potentially dangerous Request.Form value was detected — Peter
– Peter, Commented Feb 5, 2015 at 7:54

Community · Accepted Answer · 2017-05-23 12:02:23Z

1

Option 1: look at the accepted answer at: HTML-encoding lost when attribute read from input field

Option 2: Put the [AllowHtml] attribute on the model item that binds to this textbox and that will let the value into your controller where you can use HtmlEncode.

Option 3: Put the [ValidateInput(false)] attribute on your controller action, this lets everything through no matter what and then you can do your own custom validation for everything

edited May 23, 2017 at 12:02

CommunityBot

11 silver badge

answered Apr 14, 2015 at 16:54

krilovich

3,5052 gold badges25 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Oscar · Accepted Answer · 2013-11-08 12:09:02Z

0

Use System.Web.HttpUtility.HtmlEncode to encode all user input and avoid XSS atacks.

answered Nov 8, 2013 at 12:09

Oscar

14.1k9 gold badges53 silver badges84 bronze badges

1 Comment

Matthew Chambers Over a year ago

how do i add this to the control though @Html.TextAreaFor

Collectives™ on Stack Overflow

MVC c# prevent xss

2 Answers 2

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related