A potentially dangerous Request.Form value was detected from the client

2024-09-23 | code | asp.net, asp.net-mvc, validation, html-encode, request.form

问题描述

Every time a user posts something containing < or > in a page in my web application, I get this exception thrown.I don't want to go into the discussion about the smartness of throwing an exception or crashing an entire web application because somebody entered a character in a text box, but I am looking for an elegant way to handle this.Trapping the exception and showingAn error has occurred please go back and re-type your entire form again, but this time please do not use <doesn't seem professional enough to me.Disabling post validation (validateRequest="false") will definitely avoid this error, but it will leave the page vulnerable to a number of attacks.Ideally: When a post back occurs containing HTML restricted characters, that posted value in the Form collection will be automatically HTML encoded. So the .Text property of my text-box will be something & lt; html & gt;Is there a way I can do this from a handler?

提示词

None
Loading...