"<" in a text box in ASP.NET --> how to allow it?

Question

I have a textfield which displays a string which contains < and >. The code throws an error because of that. How can I allow the usage of those chars in my textfield?

Thanks :)

Answer 1

Problem is that when this gets posted to server, it will not work, doesn't matter what you try. This is the ASP.NET XSS protection, which can be disabled like so:

<%@ Page ... ValidateRequest="false" %>

Trouble is, you'll have to be very careful validating all the postback yourself. Easier way is to escape all the contents of textbox using javascript just before posting. You can escape it using same HTML escaping, then unescape in server side code.

Update: Example of escaping. This will flash the changed text on screen before postback - ideal solution is to use a hidden field for this, i.e. assign value to a hidden field, instead of that same field. This is the simplest version:

<script>
  function EscapeField(){
    document.getElementById("your client control ID").value = 
       escape(document.getElementById("your client control ID").value);
  }
</script>

And in code-behind:

this.ClientScript.RegisterOnSubmitStatement(this.GetType(), 
    "EscapeField", "EscapeField();")

Update: Again, warning - if you save HTML in your database like this, and then just display it to the client, you are directly vulnerable to XSS attacks. There are worms out there that will find and exploit your web site. Make sure you cleanse the HTML you are getting.

Answer 2

If you're in an asp.net page, you can wrap the whole of the output text in a Server.HtmlEncode("YourTextWith<and>Characters")

function and it will encode any dodgy characters for you.

If, for some reason, you're doing this in a .cs file, you can use System.Web.HttpUtility.HtmlEncode("YourTextWith<and>Characters")

before passing it to the presentation layer.

Answer 3

Convert them to < and >. In Html, < is converted to < and > is converted to > without it thinking it's part of the markup. So the string <Blah> will be <Blah>.

Edit: I forgot, to automatically convert them and escape all HTML characters (so this isn't an issue for other things), in Asp.net you can use Server.HtmlEncode(string) to automatically convert all characters that could cause issues to their HTML equivalent.

Answer 4

The easiest solution is to disable request validation in single pages

<%@ Page ... ValidateRequest="false" %>

but don't forget to enable requestValidationMode="2.0"

<system.web>
   ...
   <httpRuntime requestValidationMode="2.0" />
</system.web>

This solution could espose some threats.

---

Another smart solution is to replace via javascript text written by user to make it safe for validation: <tag> is considere dangerous, but < tag> is considered safe!

A javascript replacement can solve the problem.

function validateTxt() {
    $("textarea, input[type='text']").change(function () {
      html = $(this).val(); //get the value
      //.replace("a" , "b")  works only on first occurrence of "a"
      html = html.replace(/< /g, "<"); //before: if there's space after < remove
      html = html.replace(/</g, "< "); // add space after <
      $(this).val(html); //set new value
   });
}

$(document).ready(function () {
      validateTxt();
});

Answer 5

your problem is,you cannot use html tags in .net controls. so set the ValidateRequest="false" in your aspx page and encode the text before you saving the text.

    //encode
    private string Encode(string text)
    {
        byte[] encodedText = System.Text.Encoding.UTF8.GetBytes(text);
        return System.Convert.ToBase64String(encodedText);
    }

when you retrieving your text make sure to decode the encoded text.

    // Decode:
    private string Decode(string encodedText)
    {
        byte[] decodedText = System.Convert.FromBase64String(encodedText);
        return System.Text.Encoding.UTF8.GetString(decodedText );
    }

Answer 6

<asp:TextBox ID="TextBox1" runat="server">&lt;</asp:TextBox>

I don't know if your question is related to this or if you are getting a validateRequest issue

Answer 7

You can either use the TextBox.Text property which will HTML-encode whatever you enter

<asp:TextBox ID="TextBox1" runat="server" Text="<>"></asp:TextBox>

or you can enter the html names for < and >.

<asp:TextBox ID="TextBox1" runat="server">&lt;</asp:TextBox>

or you can enter the html codes

<asp:TextBox ID="TextBox1" runat="server">&#60;</asp:TextBox>

for the name and code conversions, check out this chart.