Anyone know why I am getting the following error? I have debugging enabled.
Server Error in '/' Application.
--------------------------------------------------------------------------------
A potentially dangerous Request.Form value was detected from the client (strContent="<p>
test</p>
").
Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. You can disable request validation by setting validateRequest=false in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case.
Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (strContent="<p>
test</p>
").
Source Error:
The source code that generated this unhandled exception can only be shown when compiled in debug mode. To enable this, please follow one of the below steps, then request the URL:
1. Add a "Debug=true" directive at the top of the file that generated the error. Example:
<%@ Page Language="C#" Debug="true" %>
or:
2) Add the following section to the configuration file of your application:
<configuration>
<system.web>
<compilation debug="true"/>
</system.web>
</configuration>
Note that this second technique will cause all files within a given application to be compiled in debug mode. The first technique will cause only that particular file to be compiled in debug mode.
Important: Running applications in debug mode does incur a memory/performance overhead. You should make sure that an application has debugging disabled before deploying into production scenario.
Stack Trace:
[HttpRequestValidationException (0x80004005): A potentially dangerous Request.Form value was detected from the client (strContent="<p>
test</p>
").]
System.Web.HttpRequest.ValidateString(String s, String valueName, String collectionName) +8725306
System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, String collectionName) +111
System.Web.HttpRequest.get_Form() +129
System.Web.HttpRequest.get_HasForm() +8725415
System.Web.UI.Page.GetCollectionBasedOnMethod(Boolean dontReturnNull) +97
System.Web.UI.Page.DeterminePostBackMode() +63
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +6785
System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +242
System.Web.UI.Page.ProcessRequest() +80
System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context) +21
System.Web.UI.Page.ProcessRequest(HttpContext context) +49
ASP.ajax_create_new_page_aspx.ProcessRequest(HttpContext context) +37
System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +181
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +75
--------------------------------------------------------------------------------
Version Information: Microsoft .NET Framework Version:2.0.50727.3615; ASP.NET Version:2.0.50727.3618
The post contains HTML elements (the <p>
tag, in your case) - this can be indication of a cross site scripting attack, which is why asp.net does not allow it by default.
You should either HTML encode before submitting (best practice), or disable the warning and potentially expose yourself to XSS.
In the web.config file, within the tags, insert the httpRuntime element with the attribute requestValidationMode="2.0". Also add the validateRequest="false" attribute in the pages element.
<configuration>
<system.web>
<httpRuntime requestValidationMode="2.0" />
<pages validateRequest="false" />
</system.web>
</configuration>
It's because you have HTML tags in your POST
request. To allow it you need to Set ValidateRequest= false
in your @Page
directives. But remember this can expose your site for Cross Site Scripting Attacks.
If this is an MVC application you can apply this attribute on Controller Action
level to ignore input validation:
[ValidateInput(false)]
Place [AllowHtml]
attribute in your model.
Make sure you're changing in the actual Web.config. I was changing it in Web.debug.config and Web.release.config files and it wouldn't work.
I had to go hunting a little within my web.config
file, specifically within the system.web
xml section, to find where I could update the <pages>
directives... as you noted. As soon as I added the validateReqest = "false"
attribute to the pages directive within web.config
file, it made everything whole again.
In my particular case, it is NOT on a production server however and this is not 'production' level code either. It's a private local server, with me only as the sole user in the environment so that makes me feel better about updating that setting. As below:
<system.web>
<pages controlRenderingCompatibilityVersion="3.5" clientIDMode="AutoID" validateRequest="false" />
</system.web>
i have ajax request with formdata so it has worked while using unvalidated keyword before retrieving data from the request. So you can try this way with tinymce text data here you don't need to modify your web config file also. my code is give below:
var data=Request.Unvalidated.Form["Key_word"];
User contributions licensed under CC BY-SA 3.0