A potentially dangerous Request.Form value was detected from the client tbpassword="9

Question

Net, I am getting an error saying

"A potentially dangerous Request.Form value was detected from the client" when I am entering a password with special characters "<" and ">" in it, I found some solutions on online saying add validrequest="false" and requestValidationMode="2.0" I did add both the statements in the web.config file and over the top of the page my web config looks like this

<system.web> <authorization> <allow roles="TARGET.DRP.ADMINS, TARGET.DRP.BUSINESS_ADMINS, TARGET.DRP.DEVICE_MNGRS, TARGET.DRP.USERS, TARGET.DRP.MANUFACTURERS"/> <deny users="?"/> </authorization> <httpRuntime requestValidationMode="2.0"/> <compilation debug="true"/> <pages validateRequest="false"/> </system.web>

And also this is showing up only if the password has "<" or ">" but if the password has both "<" and ">" it is working fine. Is there any way to resolve this.

Thank you..

If you can read the question properly I clearly mentioned that I found some stuff saying validrequest="false" and requestValidationMode="2.0" and I also said I added both the statements... — Karthik, Apr 17 '13 at 16:11

score 1 · Answer 1 · answered Apr 08 '13 at 21:26

1

If you're submiting the form with a GET it won't work unless you encode the values-

answered Apr 08 '13 at 21:26

simple-thomas

671
7
20

Isn’t `Request.Form` POST? – Ry- Apr 08 '13 at 21:26
No, you can choose the method – simple-thomas Apr 08 '13 at 21:29
The error pops up after hitting ok button.. but the thing is it is not even hitting the click event... I didnot use any forms, I used a Label and textbox with a textmode="password" – Karthik Apr 08 '13 at 22:24

score 0 · Answer 2 · answered Apr 09 '13 at 00:42

0

Place the validateRequest="false" on your web.config as:

<pages validateRequest="false" ... >

This make it work. After that you need to be careful what you render on your page and you have get from users input.

page element on msdn

answered Apr 09 '13 at 00:42

Aristos

66,005
16
114
150

I still have this error showing up even after adding the two statements in web.config – Karthik Apr 17 '13 at 16:02

A potentially dangerous Request.Form value was detected from the client tbpassword="9

2 Answers2