473,785 Members | 2,219 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

ValidateRequest =False HtmlEncode and The Best Method

I guess I'm not understanding this correctly.

I have to set "ValidateReques t=False" for my asp.net 1.1 page that has a
TextBox... so that I can avoid an error... if some user enters
some html or script coding into it. (Should I HtmlEncode it with
Server.htmlEnco de or HttpServerUtili ty.HtmlEncode ???)

From what I've read... I guess I'm supposed to do it this way:
1. HtmlEncode the user input that's in the TextBox.
2. Save it to the database.
then...
3. Load it from the database.
4. Decode it.
5. Display it to the user.

Isn't step #1 wasting extra database space? (Since encoding changes some
single characters into 4 characters.)
And step #2 is saving "safe text". (But it can't really harm anyone just
sitting in the database... as unsafe-text.)
And doesn't #4 convert the safe-text back into UNSAFE text? (Is that
wise????)

=============== ========

Or would this method make more sense:
A. Save the unsafe-text to the database... as-in.
then...
B. Load it from the database.
C. Encode it. (Converting unsafe-text to safe-text)
D. Display it to the user.

Help!

Sep 5 '06 #1
0 1505

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

1
20725
by: mar | last post by:
Does anybody know what configuration section should i set to false here. I also tried setting the page directive to false but that didn't fix it. Thanks! mc A potentially dangerous Request.Form value was detected from the client (ResultInput="...="1.0"?> <ResultData xmlns:xs...").
0
6465
by: Martin Colmenares | last post by:
After I set my <%@ page ValidateRequest="false" %> , I still get the error illustrated below. The msdn mentioned something about filtering using the HTMLEncode. This is a snippet of the code that should display the result. </head> <body MS_POSITIONING="GridLayout" bgcolor="gainsboro"> <form id="Form1" method="post" runat="server"> <INPUT style="Z-INDEX: 101; LEFT: 248px; POSITION:absolute; TOP:184px" type="button" value=" OK "...
2
15884
by: Tim Zych | last post by:
I'm trying to stop .Net from validating data entered into a textbox. When I enter < or > .Net returns an error: potentially dangerous Request.Form value was detected from the client... so a search on google indicates a couple of options: 1. Add validateRequest = "false" in the page directive. So I add it: <%@ Page Language="vb" AutoEventWireup="false" Codebehind="addcode.aspx.vb"
2
1393
by: AFN | last post by:
I have a form with 15 fields. I want users to be able to enter "<" and ">" characters into 1 of those fields without IIS catching it and disallowing the whole page. I did some reading and I *think* that means I MUST set ValidateRequest=False. So, two questions: 1) Do I have to then pass the results of every one of those 15 fields into HtmlEncode? like strAfter = HtmlEncode(txtField1.text)? That's annoying when I only want to...
8
1868
by: Max Metral | last post by:
Ok, I have a global page class derived from System.Web.UI.Page, let's call it BasePage. I have another class derived from that called MemberPage. It checks the Form collection if it's a post for some "common" fields. Now, I have an aspx page whose code behind derives from BasePage, and which sets ValidateRequest=False in the page directive of the aspx. I can post <script> tags and such with no problems. However, when I make the...
4
1414
by: Raterus | last post by:
I'm assuming the answer to this is a big "NO", but is it possible to disable validation checks for a particular control, instead of setting ValidateRequest=False in the page directive? --Michael
4
2152
by: Dave H | last post by:
If put this into my Web.config. Shouldn't this turn off the ValiateRequest app wide? <configuration> <system.web> <pages buffer="true" validateRequest="false" /> I pass SQL around to pages, and sometimes, this causes the 'Cross Site
2
2067
by: \A_Michigan_User\ | last post by:
*WITHOUT* using: ValidateRequest="False" for the whole page (or my whole site).... How would I trap/detect that a textBox contains some illegal characters? (I'm using asp.net v1.1 and vb.net) Thanks.
2
1500
by: sreenipvr | last post by:
hi frnds can any of u tell me how can we increase the performance by making Validaterequest=false?
0
9483
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can effortlessly switch the default language on Windows 10 without reinstalling. I'll walk you through it. First, let's disable language synchronization. With a Microsoft account, language settings sync across devices. To prevent any complications,...
0
9956
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each protocol has its own unique characteristics and advantages, but as a user who is planning to build a smart home system, I am a bit confused by the choice of these technologies. I'm particularly interested in Zigbee because I've heard it does some...
1
7504
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new presenter, Adolph Dupré who will be discussing some powerful techniques for using class modules. He will explain when you may want to use classes instead of User Defined Types (UDT). For example, to manage the data in unbound forms. Adolph will...
0
6742
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
5386
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
0
5514
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
4055
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
2
3658
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.
3
2887
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.