Special character causes "A potentially dangerous Request.Form value"

Question

I'm building a footnote editor for a specific need and I need a drop list that shows special characters such as a dagger (&#134). Not sure if it matters, but the drop list is in a ajax modal popup form. Whenever I try to display the popup form, I get the error "A potentially dangerous Request.Form value was detected from the client (ctl00$MainContent$ucFootNoteList$DropDownList1="*, &#134")."

I tried adding <httpRuntime requestValidationMode="2.0" /> to the Web.config file.

How do I show a special character in this scenario without this error coming up?

are you using net 4?, if not then try instead validateRequest=false. If yes then try checking your web.config — magallanes, Oct 27 '12 at 17:25

score 2 · Accepted Answer · answered Oct 27 '12 at 17:22

2

You could set the validateRequest property on the Page header of the corresponding WebForm to disable request validation and allow posting HTML characters:

<%@ Page validateRequest="false" %>

This could also be done globally for all WebForms in the web.config:

<pages validateRequest="false" />

Here's an article on MSDN where you could read more about request validation in ASP.NET.

answered Oct 27 '12 at 17:22

Darin Dimitrov

1,023,142
271
3,287
2,928

Thanks, everyone. I'll use this for now, let the project leader decide if special characters are important enough to turn off validation. – Steve Wash Oct 27 '12 at 17:51

score 1 · Answer 2 · answered Oct 27 '12 at 17:23

You can disable the ValidateRequest property but [very important!] please sanitize your input using a library like AntiXss, like this one:

http://wpl.codeplex.com/

Otherwise you will be vulnerable to input attacks (injections, xss etc.)

In fact the reason your request is "potentially dangerous" is because the runtime thinks some is trying to inject some HTML, that's why you cant insert < bla >

score -1 · Answer 3 · answered Oct 27 '12 at 17:41

Disable the ASP.NET request validation feature. To do so, in Web page's .aspx file, set the Page ValidateRequest setting that is shown here.

<%@ Page ValidateRequest="false"%>

Alternately, in the Web application's Web.config file, set the validateRequest attribute of the section to false.

<configuration>
    <system.web>
        <pages validateRequest="false" />
        </system.web>
    </configuration>

Source : http://msdn.microsoft.com/en-us/library/ee517280.aspx

Special character causes "A potentially dangerous Request.Form value"

3 Answers3

Linked