potentially dangerous Request.Form value was detected

[Steve Richter]

getting this "potentially dangerous Request.Form value was detected"
exception with a textbox which I have populated with some source
code. I think I am getting the exception when I click OK on the web
page, but that is one of my question, so I am not sure ;)

I am reading how to disable request validation,
http://www.asp.net/faq/RequestValidation.aspx#5

but I dont want to do that. I would rather catch the exception. But I
guess that is not workable because at the time the validation
exception is thrown, the individual control with the invalid data is
not yet know. correct?

should I Server.HtmlEncode the data I put in the textbox before
posting to the browser? If I do that the data will display in encoded
form ( correct? ) and I dont want that.

how do I accept textbox input from a form that fails RequestValidation
without disabling that validation?

thanks,

-Steve

[bruce barker]

request validation is looking for script and html attacks. so typing a
"<" or "&#" in a textbox will fire this error on postback. each control
checks this when it loads the postback data. as this is a page event,
you can only catch the error with a global error handler.

if validation is on, you should never set Text of a webcontrol to these
character. if you htmlencode, the browser will convert to the correct
values, but will cause a postback error.

there is no way to display these values in a textbox and postback unless
you turn off validation.

-- bruce (sqlwork.com)

Steve Richter wrote:

getting this "potentially dangerous Request.Form value was detected"
exception with a textbox which I have populated with some source
code. I think I am getting the exception when I click OK on the web
page, but that is one of my question, so I am not sure ;)

I am reading how to disable request validation,
http://www.asp.net/faq/RequestValidation.aspx#5

but I dont want to do that. I would rather catch the exception. But I
guess that is not workable because at the time the validation
exception is thrown, the individual control with the invalid data is
not yet know. correct?

should I Server.HtmlEncode the data I put in the textbox before
posting to the browser? If I do that the data will display in encoded
form ( correct? ) and I dont want that.

how do I accept textbox input from a form that fails RequestValidation
without disabling that validation?

thanks,

-Steve

[Steve Richter]

On Jun 26, 6:24 pm, bruce barker <[e-mail]:

request validation is looking for script and html attacks. so typing a
"<" or "&#" in a textbox will fire this error on postback. each control
checks this when it loads the postback data. as this is a page event,
you can only catch the error with a global error handler.

if validation is on, you should never set Text of a webcontrol to these
character. if you htmlencode, the browser will convert to the correct
values, but will cause a postback error.

there is no way to display these values in a textbox and postback unless
you turn off validation.

ok. thank you.