6

Is there a way to disable request validation for just certain textboxes instead of the whole page? I'm using Server.HtmlEncode/Decode because users are legitimately using < and > characters but I don't want to use ValidateRequest="false" on the whole page because someone could add a textbox later and forget to escape the input in which case I would want validation to occur so the error would be discovered rather than be vulnerable to html injection.

It seems like there has to be a simple solution but I'm not having any luck finding it.

(Webforms not MVC)

Davy8
  • 30,868
  • 25
  • 115
  • 173
  • Well that's painful -> .NET 4.5 wasn't released when I posted my answer. – Tommy Nov 02 '12 at 19:04
  • @Tommy I know, nor was it when I asked the question, however it is the more up to date answer and would be more useful to future users reading this. You answer is still upvoted though. – Davy8 Nov 02 '12 at 19:06
  • Haha - I know :) Nothing personal, but I did have to come check it out. PS - looks like I was close with my .NET 5.0 comment below. – Tommy Nov 02 '12 at 19:09
  • @Tommy - update your answer and I'll delete mine :) – ajbeaven Nov 02 '12 at 20:54
  • 2
    @ajbeaven - No way dude, its all yours. I didn't know it was added to .NET 4.5, so I learned something new! :) – Tommy Nov 02 '12 at 22:04

2 Answers2

3

No, request validation is for the entire request and cannot be done on an element by element basis. Request validation is enabled by ASP.NET by default and is to help those out that do not know about sanitizing HTML inputs from script injection attacks. Posted some links below for further reading:

MSDN

Stackoverflow

Community
  • 1
  • 1
Tommy
  • 39,592
  • 10
  • 90
  • 121
  • I find it incredulous that there's no way to do it per-control. Even someone that knows what they're doing can occasionally forget and it'd be good to have a fallback. However +1 anyway because I haven't been able to find anything to the contrary. If nothing comes up by tomorrow I'll accept. – Davy8 Aug 23 '10 at 22:42
  • Maybe something for .NET 5.0 :) – Tommy Aug 23 '10 at 22:47
  • I agree that it's ridiculous that this isn't supported, but my understanding is that @Tommy is correct, it really isn't possible in current ASP.NET. – Stuart Aug 23 '10 at 23:37
  • If you want to turn this on for an individual control you will have to do it yourself. Honestly if you use reflector to look at the algorithm it isn't terribly complicated. Essentially it just looks for some very basic offending characters and kicks them out. However, I might mention that it is using an "unsafe" keyword for performance reasons, but it has to look at the entire request, not just a single control. – Josh Aug 24 '10 at 03:33
2

According to this answer, you can do it in .NET 4.5:

http://msdn.microsoft.com/en-us/library/system.web.ui.control.validaterequestmode.aspx

Community
  • 1
  • 1
ajbeaven
  • 9,265
  • 13
  • 76
  • 121