Creating a webservice that accepts XML as a string

Question

I have been trying to create a webservice that needs to allow the client to send thru 3 parameters being Username, Password and XML_In all 3 of type string. This then sends the variables to a Stored procedure which processes the data and returns an XML string which is then returned to the client.

The Stored procedure works 100% but I'm getting an error with the XML being sent thru as a string. From reading up most gave the suggestion of adding <httpRuntime requestValidationMode="2.0"/> and <pages validateRequest="false"> to my web.config which works but that would then apply to my entire site which I dont want at all.

The other suggestion was to place it in the @Page part but that does not apply to a web service as it has no user defined layout. Please see my code below and help. I'm still quite a newbie to .Net thus the reason I'm doing 90% of it in SQL.

The error That gets returned is :

System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (XML_In="<senddata><settings ...").
   at System.Web.HttpRequest.ValidateString(String value, String collectionKey, RequestValidationSource requestCollection)
   at System.Web.HttpRequest.ValidateHttpValueCollection(HttpValueCollection collection, RequestValidationSource requestCollection)
   at System.Web.HttpRequest.get_Form()
   at System.Web.Services.Protocols.HtmlFormParameterReader.Read(HttpRequest request)
   at System.Web.Services.Protocols.HttpServerProtocol.ReadParameters()
   at System.Web.Services.Protocols.WebServiceHandler.CoreProcessRequest()

here's the code:

Imports System.Web.Services
Imports System.Web.Services.Protocols
Imports System.ComponentModel
Imports System.Xml
Imports JumpStart.Framework.Database

' To allow this Web Service to be called from script, using ASP.NET AJAX, uncomment the following line.
' <System.Web.Script.Services.ScriptService()> _
<System.Web.Services.WebService(Namespace:="http://mydomainname.co.za/")> _
<System.Web.Services.WebServiceBinding(ConformsTo:=WsiProfiles.BasicProfile1_1)> _
<ToolboxItem(False)> _
Public Class LeadProcessor
    Inherits System.Web.Services.WebService

    <WebMethod()> _
    Public Function Lead_Processing(ByVal UserName As String, ByVal PassWord As String, ByVal XML_In As String) As XmlDocument
        Dim poDSL As New DSL
        Dim Result As String
        Dim XML_Out = New XmlDocument()

        Result = poDSL.ExecuteProcedure_ExecuteScalar("DECLARE @Result XML " & _
                                             "EXEC [dbo].[APP_InsertLeadFromXML] " & _
                                            "@Username = N'" & UserName & "', " & _
                                            "@Password = N'" & PassWord & "', " & _
                                            "@ParmListXML = '" & XML_In.ToString & "', " & _
                                            "@XMLResult = @Result OUTPUT " & _
                                            "SELECT @Result")

        XML_Out.LoadXml(Result)

        Return XML_Out
    End Function

Answer 1

I agree with CodeCaster comment (new projects - WCF or WebApi).

But if you can't change it now, consider use a XMLDocument as parameter, or an XElemento, or directly, do a Base64 transform of the text, in order to avoid that errors.

Code for your service' client:

your_proxy.Lead_Processing(sUserName, sPassWord, Convert.ToBase64String(Encoding.UTF8.GetBytes(sXML))

Then, in your service, do this

 <WebMethod()> _
    Public Function Lead_Processing(ByVal UserName As String, ByVal PassWord As String, ByVal XML_In As String) As XmlDocument

    Dim oData As Byte() = Convert.FromBase64String(XML_In)
    Dim sDecodedXML As String = System.Text.Encoding.UTF8.GetString(oData)

    Dim poDSL As New DSL
    Dim Result As String
    Dim XML_Out = New XmlDocument()

    Result = poDSL.ExecuteProcedure_ExecuteScalar("DECLARE @Result XML " & _
                                         "EXEC [dbo].[APP_InsertLeadFromXML] " & _
                                        "@Username = N'" & UserName & "', " & _
                                        "@Password = N'" & PassWord & "', " & _
                                        "@ParmListXML = '" & sDecodedXML  & "', " & _
                                        "@XMLResult = @Result OUTPUT " & _
                                        "SELECT @Result")

    XML_Out.LoadXml(Result)

    Return XML_Out
End Function

Hope it helps

Edit: Your service with base64. We're telling that Asmx it's almost a legacy tech. New projects may use WCF tech (I can't teach you WCF in a few lines). You can put that code into your asmx service. You can use that code in the way I edited my answer.