ValidateRequest ="false" for single control

Question

I'm wanting to allow users to enter HTML in only a single TextBox. I understand it's possible to change ValidateRequest in the page directive to false in order to remove protection.

I'm guessing that this allows HTML to be entered in any TextBox on the page. Is there anyway to apply ValidateRequest="false" on only a single control?

Thanks for any help.

score 19 · Accepted Answer · edited Jun 20 '20 at 09:12

19

No, the request validation is for the entire request or nothing.

The validation was added as a default to protect developers who are clueless about input validation. If you know that all input has to be treated as unsafe and know how to properly encode data that you use from the input to protect yourself from things like SQL injection and cross site scripting, you can turn the validation off.

Edit:

Update: In .NET 4.5 the ValidateRequestMode property was added, which allows excluding controls from the page global validation.

edited Jun 20 '20 at 09:12

Community

1
1

answered Mar 18 '10 at 01:10

Guffa

687,336
108
737
1,005

2

@ajbeaven: Interresting. I added information about this possibility to keep the answer up to date. – Guffa Nov 01 '12 at 23:00

score 5 · Answer 2 · edited Jul 12 '16 at 11:54

5

New in .NET 4.5 : You can set ValidateRequestMode="Disabled" on a control. See MSDN.

edited Jul 12 '16 at 11:54

Stacked

6,892
7
57
73

answered Nov 01 '12 at 16:28

Patrick J Collins

959
1
14
26

score 0 · Answer 3 · answered Mar 18 '10 at 01:28

0

Try turning ValidateRequest off and use this method for removing markup from each individual control/parameter:

public static string RemoveMarkUp(this string s) {
   return Regex.Replace(s, @"<[a-zA-Z\/][^>]*>", string.Empty);
}

answered Mar 18 '10 at 01:28

Max Toro

28,282
11
76
114

4

-1 You don't need to remove anything, it just needs to be properly encoded. I hate it when I type something in and then parts of it get blatantly stripped out. – Josh Stodola Mar 18 '10 at 01:31
@Josh Stodola: Depends on the programmer. If you are using ValidateRequest="true" then you definately do not want any markup, not even encoded markup. Also, the process of encoding strings for display in HTML is usually done when rendering the page, not before storing the data. – Max Toro Mar 18 '10 at 01:43
+1 for -1 being too harsh: It wasn't wrong, just a different solution with different pros and cons. – Scott Stafford Oct 13 '10 at 14:39

ValidateRequest ="false" for single control

3 Answers3

Edit:

Linked