hiddenfield living out of scope?

[KBTibbs]

My ASP.NET page generates some HTML, then sticks it into a hiddenfield so a javascript can access it and write it to a popup window.

I had to disable validation for this page, as HTML inside a field triggers ASP.NET's cross-site scripting security.

Now, this was all working well and good until I changed my navigation menus from plain images and anchors to ASP:imagebutton s. The navi menu is on my masterpage and in now within the same <form> block as the contentplacehol der. This is the only change I've done.

Now, when I click a button to go to a different page, all of my pages trigger the ASP.NET cross-site scripting security because of the hiddenfield on a single page.

Now, to try and fix this, I've set the hiddenfield's viewstate to false. I hope this would stop it from posting back, to no avail. Also, I've added the following event:

protected void reportField_Unload(object sender, EventArgs e)
{
    reportField.Value = "";
}

But still, the security is tripped. It seems like this hiddenfield is living way outside it it's scope... why?

[KBTibbs]

It seems the hiddenfield isn't living too long, it's just that its life is long enough to reach the other page's request validation.

So, it occurs to me that I can disable request validation with

<% Page ValidateRequest ="false"%>

and then call Request.Validat eRequest() in the page's OnLoad event. The hiddenfield should be expired by then, and we still get input validation early enough for security, yes?

or maybe if I could just disable validation on this one field... alas hiddenfield does not accept "CausesValidati on = false"