Asp – When is it ok to disable event validation on a page

asp.netasp.net-ajax

I am using ASP.NET ajax to dynamically add/remove controls from a page without using full postbacks. The UI is very complicated. Under certain scenarios, when a control on the page causes a full postback, after changing the controls via async postbacks, I get this error:

Invalid postback or callback argument. Event validation is enabled using '<pages enableEventValidation="true"/>'

I can fix it by setting EnableEventValidation="false" at the page level.

What are the implications of doing this? Are there times when it is ok to do this or is this a hack?

Best Answer

If you have a WYSIWYG input text box or a textbox expecting HTML, then you have to disable validation or do some JavaScript hack.

The catch is that you will need to provide thorough validation to prevent XSS and such.

Related Topic