rules for matching a "A potentially dangerous Request.Form value"

Question

I would like to know what rules are used to determine what is a potentially dangerous form value so that I can write client side validation to prevent it hitting the server. Ideally I would like to know how the framework determines what is a potentially dangerous combination of characters, so I could use the same rules in my custom validator to prevent them ever hitting the server.

Not exactly a rule but using *Prepared Statements* usually reduces the chance of having a client submit a set of *special* characters that could potentially jeopardize your database. — npinti, Jun 26 '12 at 07:26
You could process the text you are being submitted and remove any special characters. — npinti, Jun 26 '12 at 07:38
yeah i know that's what i was saying allowing script tags has nothing to with the db — bluntstone, Jun 26 '12 at 07:45
exactly @npinti but what are those special characters, what does the framework use to determine what they are — bluntstone, Jun 26 '12 at 07:46
I was essentially looking for this: [enter link description here][1] [1]: http://stackoverflow.com/questions/8744002/asp-net-potentially-dangerous-request-javascript-regex — bluntstone, Jun 27 '12 at 01:10

score 2 · Answer 1 · edited May 23 '17 at 11:56

Reasons:

This error is generally arised when a valid html is entered in text input. i.e. with opening and closing html tags <****>.
It is also caused due to entering html entites like   & < > " etc.
In simple words You can say that if text-input contains some symbols like ">, &, <, ="; etc, it will be recognized as dangerous value.

For resolving You can use:

<system.web>
    <httpRuntime requestValidationMode="2.0" />
</system.web>

in your web.config to validate such inputs.

OR

You can htmlencode the input using:

String clean_value = Server.HtmlEncode(TextBox1.Text);

Following Articles may help you:

How To Catch HttpRequestValidationException

http://www.cryer.co.uk/brian/mswinswdev/ms_vbnet_server_error_potentially_dangerous.htm

A potentially dangerous Request.Form value was detected from the client

Hope this helps.

I actually don't want to do that, I know I can switch off the validation or switch it on I am more concerned about what is considered a potentially dangerous form value. I know the obvious ones like — bluntstone, Jun 26 '12 at 07:33
@bluntstone Html entities mainly cause this error. See the updated answer. — talha2k, Jun 26 '12 at 07:45

score 0 · Answer 2 · answered May 25 '23 at 03:56

The validateRequest = false is generally not recommended. This is what I did:

On the server side, you can use this:

Create a hidden field in asp.net and encode it.

hiddenFieldMessage.Value = Uri.EscapeDataString(dangerousString);

Then in Javascript, create a text area and decode the encoded value.

<script>
    (function () {
        
        const content = document.getElementById('<%= hiddenFieldMessage.ClientID %>').value;
        // decode the content back to html
        var textArea = document.createElement("textarea");
        textArea.innerHTML = decodeURIComponent(document.getElementById('<%= hiddenFieldMessage.ClientID %>').value);
        const content = textArea.value;  // decoded value
   })

This way, there is no need to switch off the validation (which will make your webpage vulnerable to injection attacks)

rules for matching a "A potentially dangerous Request.Form value"

2 Answers2