hiddenfield living out of scope?

[KBTibbs]

My ASP.NET page generates some HTML, then sticks it into a hiddenfield so a javascript can access it and write it to a popup window.

I had to disable validation for this page, as HTML inside a field triggers ASP.NET's cross-site scripting security.

Now, this was all working well and good until I changed my navigation menus from plain images and anchors to ASP:imagebuttons. The navi menu is on my masterpage and in now within the same <form> block as the contentplaceholder. This is the only change I've done.

Now, when I click a button to go to a different page, all of my pages trigger the ASP.NET cross-site scripting security because of the hiddenfield on a single page.

Now, to try and fix this, I've set the hiddenfield's viewstate to false. I hope this would stop it from posting back, to no avail. Also, I've added the following event:

protected void reportField_Unload(object sender, EventArgs e)
{
    reportField.Value = "";
}

But still, the security is tripped. It seems like this hiddenfield is living way outside it it's scope... why?

[KBTibbs]

It seems the hiddenfield isn't living too long, it's just that its life is long enough to reach the other page's request validation.

So, it occurs to me that I can disable request validation with

<% Page ValidateRequest="false"%>

and then call Request.ValidateRequest() in the page's OnLoad event. The hiddenfield should be expired by then, and we still get input validation early enough for security, yes?

or maybe if I could just disable validation on this one field... alas hiddenfield does not accept "CausesValidation = false"