C# – requestvalidationmode=”2.0″ validaterequest=”false” in web.config not working

.net-4.0asp.netcnet

I'm looking for a bit of help as this is now driving me crazy.

I have a tinyMCE text editor on my page which is populated with content which is already stored in the database as html.

eg.
<p>first paragraph</p> <p>second paragraph</p>
etc, etc with no problems there.

but when I make a change in the editor and then try to update the content in the database I get the error
potentially dangerous request.form value was detected from the client

I made all the recommended changes in the web.config

requestvalidationmode="2.0"
validaterequest="false"

But still get the potentially dangerous request.form value was detected from the client error.
This is happening in .NET 4.0 any help/advice would be great.

Best Answer

I wouldn't even try to enable this on a site-wide level in the web.config file - just do it per page, when you know specifically input data is safe:

<%@ Page ... ValidateRequest="false" %>

You can use an Umbraco control exposed specifically for this purpose from within a Template as such:

<umbraco:DisableRequestValidation runat="server" />

Related Solutions

C# – A potentially dangerous Request.Form value was detected from the client

The problem you're having is that in one of your text boxes you have put html tags or just the < > symbols and the .net framework tracks that as a potential dangerous script. This is to prevent people from putting malicious script tags in the input fields.

You can work around this by putting in your page directive ValidateRequest="false" you will also have to put in your web.config <httpRuntime requestValidationMode="2.0" ... />

Why potentially dangerous request error even ValidateRequest = false

In .net framework 4.0 you have to set <httpRuntime requestValidationMode="2.0"/> markup in web.config.

<system.web>
     <compilation debug="false" targetFramework="4.0" />
     <httpRuntime requestValidationMode="2.0"/>
</system.web>

Have a look at reference article - ASP.NET 4 Breaking Changes #1: requestValidationMode cause ValidateRequest=False to fail.

Best Answer

Related Solutions

C# – A potentially dangerous Request.Form value was detected from the client

Why potentially dangerous request error even ValidateRequest = false

Related Topic