Why is ValidateInput(False) not working?

Question

I am converting an application I created using webforms to the asp.net mvc framework using vb.net. I have a problem with one of my views. I get the yellow screen of death saying "A potentially dangerous Request.Form value was detected from the client" when I submit my form. I am using tinymce as my RTE. I have set on the view itself

ValidateRequest="false"

I know that in MVC it doesn't respect it on the view from what I've read so far. So I put it on the controller action as well. I have tried different setups:

<ValidateInput(False), AcceptVerbs(HttpVerbs.Post)> _

...and...

<AcceptVerbs(HttpVerbs.Post), ValidateInput(False)> _

...and like this as well...

<ValidateInput(False)> _
<AcceptVerbs(HttpVerbs.Post)> _

Just to see if it made a difference, yet I still get the yellow screen of death. I only want to set it for this view and the specific action in my controller that my post pertains to. Am I missing something?

score 137 · Answer 1 · edited Apr 19 '13 at 10:56

137

With asp.net 4, you'll need to configure the validation mode in the web.config as well.

Set the following as a child of the <system.web> element:

<system.Web>
  ...
  <httpRuntime requestValidationMode="2.0"/>

Asp.Net 4 sets the requestValidationMode to 4.0 by default, which tells the system to perform request validation before the BeginRequst phase of the HTTP request. The validation will occur before the system reaches the action attribute telling it not to validate the request, thus rendering the attribute useless. Setting requestValidationMode="2.0" will revert to the asp.net 2.0 request validation behavior, allowing the ValidateInput attribute to work as expected.

edited Apr 19 '13 at 10:56

Luke Puplett

42,091
47
181
266

answered Mar 27 '10 at 20:32

Jim Geurts

20,189
23
95
116

17

is this going to be 'fixed' for MVC 3? – Simon_Weaver Apr 20 '10 at 03:42
9

What are the other things to watch out for if we revert it to 2.0? – Josh Kodroff May 13 '13 at 19:18
I spent about 4 hours battling this problem. When I saw your solution in my frustration I didn't think it would work. It did. I felt such a relief when that line of code ran without the "dangerous value" error. Thanks very much. – Steve Gaines Jun 26 '18 at 14:31
Can we use ValidateInput(false) with HttpGet action method, which takes no param ? – Sandeep Pandey Apr 12 '21 at 18:14

score 17 · Accepted Answer · answered Apr 30 '09 at 16:09

17

Are you sure that the controller action being posted to is the one you have the attributes on?

answered Apr 30 '09 at 16:09

Chad Moran

12,834
2
50
72

You are a life saver! I burnt myself on this project yesterday. This has been bugging me since last night and I thought sleeping on it would help. But yeah, my form action was empty from me testing my jQuery validation on that view and I forgot to put the Url.Action back. I feel embarassed lol. – Dekryptid Apr 30 '09 at 16:22
In my case, I have a method which receives both a full model and some extra parameters (like `Save(SomeModel model, string inputFromMemo)`). Firstly I coded just `Save(SomeModel model)`. Adding the other parameter fixed it. – Marcus Vinicius Pompeu Mar 13 '16 at 08:31
In my case I have an mvc controller with index controller(httpGet) that only returns jsonData. I have tried all the combination but validate input is not working for me. – Sandeep Pandey Apr 12 '21 at 17:18

score 4 · Answer 3 · edited Apr 10 '18 at 12:45

When you are using your own model binders which implement the IModelBinder interface you will notice that those custom model binders always validate the data, regardless any attributes. You can add few lines of code to make the custom model binders respect the ValidateInput filter of the actions:

// First check if request validation is required
var shouldPerformRequestValidation = controllerContext.Controller.ValidateRequest && bindingContext.ModelMetadata.RequestValidationEnabled;

// Get value
var valueProviderResult = bindingContext.GetValueFromValueProvider(shouldPerformRequestValidation);
if (valueProviderResult != null)
{
    var theValue = valueProviderResult.AttemptedValue;

    // etc...
}

This is explained very nicely by Martijn Boland here: http://blogs.taiga.nl/martijn/2011/09/29/custom-model-binders-and-request-validation/

score 3 · Answer 4 · answered Jun 13 '16 at 12:36

3

You can try accessing the field like HttpContext.Request.Unvalidated.Form["FieldName"]

answered Jun 13 '16 at 12:36

Chitta

185
2
15

Should be: HttpContext.Current.Request.Unvalidated.Form["FieldName"] – Bob Quinn Jun 07 '17 at 02:44

score 1 · Answer 5 · edited Feb 06 '23 at 12:51

1

Add the following line of code:

GlobalFilters.Filters.Add(new ValidateInputAttribute(false));

to the Application_Start() method. Hehe good

edited Feb 06 '23 at 12:51

Trọng Vũ Minh

3
2

answered Dec 18 '13 at 11:12

Vishnu Vikraman Sreekala

853
14
33

6

This will disable validation on ALL controller actions, which you probably don't want to do. – Matt Frear Feb 18 '14 at 14:19
1

Nonetheless, I think it's useful to know you can do this – Colin Dec 11 '21 at 00:11

score 1 · Answer 6 · edited May 23 '17 at 12:17

1

Please note that these suggestions will not fix the problems caused by a bug that occurs when you have to use [ValidateInput(false)] in combination with a FormCollection.

See: ASP.NET MVC 3 ValidateRequest(false) not working with FormCollection

edited May 23 '17 at 12:17

Community

1
1

answered Dec 08 '10 at 09:21

Frank van Eykelen

1,926
1
23
31

score 0 · Answer 7 · answered Jan 29 '17 at 06:30

If you use an input model and use an AllowHtml on the property you want, you will be unblocked.

public class InputModel
{
    [AllowHtml]
    public string HtmlInput { get; set; }
}

...
[ValidateInput(false)]
public async Task<ActionResult> ControllerMethod(InputModel model)
{
}

Why is ValidateInput(False) not working?

7 Answers7

Linked