I am stuck in the middle of a problem
System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client for a week. This occurs due to multiline textbox.To solve this I added a property "Validation Request=false" in the header of the page and in web.config page. But it has not worked. Pls help me out.
I want to save <span></span> tag with the help of a multiline textbox into a database. It is during that time this prob occurs. Otherwise it works properly.
-
And your question is...?Edwin de Koning– Edwin de Koning2011-08-05 06:32:24 +00:00Commented Aug 5, 2011 at 6:32
-
it is worked for fckeditor but not work for multiline text box.jyoti– jyoti2011-08-05 06:36:13 +00:00Commented Aug 5, 2011 at 6:36
Add a comment
|
3 Answers
Add the following attribute to your httpruntime tag in web.config:
<httpRuntime requestValidationMode="2.0" />
After setting this value, set validateRequest="false" in the pages tag:
<pages validateRequest="false">
Comments
I think you better encode your html before sending it to the database
Use Server.Encode(YourTextBoxId);
for example if your command is like :
cmd.Parameters.AddWithValue("@htmlcodefromtextbox", TextBox1.Text);
try this instead
cmd.Parameters.AddWithValue("@htmlcodefromtextbox", Server.Encode(YourTextBoxId));
and if your Command is like:
cmd.Parameters.Add("@htmlcodefromtextbox", SqlDbType.Text).Value = TextBox1.Text;
use this instead
cmd.Parameters.Add("@htmlcodefromtextbox", SqlDbType.Text ).Value =Server.HtmlEncode( TextBox1.Text);
i am Sure this will do finely.
Comments
You need to add EnableEventValidation="false" either in the page directive of the afflicted page or in the web.config.
It isn't advised however and enabling it means you should take stringent steps to sanitise the input as much as possible.
Regards
Si
1 Comment
Brian Dishaw
You will open your site to a number of security vulnerabilities by doing so. If you must disable event validation, do so at the page level and not at the site level. Also, you will need to ensure that you sanitize the data coming from the box before displaying it back to the users of your site.