How to use Request.Unvalidated with ASP.NET MVC 4

asp.net-mvc-4validation

According to this link, now we can use Request.Unvalidated to access a raw value of a form field wihout triggering request validation (and see dreadful error message A potentially dangerous Request.Form…). Unfortunately I could not get it work.

Web.config

<httpRuntime targetFramework="4.5" requestValidationMode="4.5" />

A simple field in view model:

// [AllowHtml] - even I tried this, it still did not work :(
public string Description { get; set; }

And controller action:

[HttpPost]
public ActionResult Edit([Bind(Prefix = "Edit")] EditModel model)
{
  string s = Request.Unvalidated.Form["Edit.Description"];
}

I still see error "A potentially dangerous Request.Form…", why? Tried google but there was no example with ASP.NET MVC.

Toolbox: I'm working with a ASP.NET MVC 4 project, targetting .NET 4.5, and VS2012.

Thanks,

UPDATE: Using AllowHtml with Description property fixed my problem, even don't need Request.Unvalidated. There is still an issue as I commented below in @webdeveloper's answer.

Best Answer

Look at this links:

They will help you to understand, how does it works.

Related Solutions

Javascript – How to validate an email address in JavaScript

Using regular expressions is probably the best way. You can see a bunch of tests here (taken from chromium)

function validateEmail(email) {
    const re = /^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
    return re.test(String(email).toLowerCase());
}

Here's the example of regular expresion that accepts unicode:

const re = /^(([^<>()[\]\.,;:\s@\"]+(\.[^<>()[\]\.,;:\s@\"]+)*)|(\".+\"))@(([^<>()[\]\.,;:\s@\"]+\.)+[^<>()[\]\.,;:\s@\"]{2,})$/i;

But keep in mind that one should not rely only upon JavaScript validation. JavaScript can easily be disabled. This should be validated on the server side as well.

Here's an example of the above in action:

function validateEmail(email) {
  const re = /^(([^<>()[\]\\.,;:\s@\"]+(\.[^<>()[\]\\.,;:\s@\"]+)*)|(\".+\"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
  return re.test(email);
}

function validate() {
  const $result = $("#result");
  const email = $("#email").val();
  $result.text("");

  if (validateEmail(email)) {
    $result.text(email + " is valid :)");
    $result.css("color", "green");
  } else {
    $result.text(email + " is not valid :(");
    $result.css("color", "red");
  }
  return false;
}

$("#email").on("input", validate);

<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.1/jquery.min.js"></script>

<label for=email>Enter an email address:</label>
<input id="email">
<h2 id="result"></h2>

Regex – How to validate phone numbers using regex

Better option... just strip all non-digit characters on input (except 'x' and leading '+' signs), taking care because of the British tendency to write numbers in the non-standard form +44 (0) ... when asked to use the international prefix (in that specific case, you should discard the (0) entirely).

Then, you end up with values like:

 12345678901
 12345678901x1234
 345678901x1234
 12344678901
 12345678901
 12345678901
 12345678901
 +4112345678
 +441234567890

Then when you display, reformat to your hearts content. e.g.

  1 (234) 567-8901
  1 (234) 567-8901 x1234

Related Topic