Alternative to ValidateRequest="false"

Question

Is there a way to prevent the error "A potentially dangerous Request.Form value was detected from the client" other than setting ValidateRequest="false"?

Update: I removed the "on the page" part. I'd like to not use ValidateRequest="false" at all, on the page or in web.config.

Answer 1

1 You can also add javascript validation on your input

2 You can Add Custom Validator

Answer 2

Check out the new ASP.NET 4.5 request validation features.

If you set

<httpRuntime requestValidationMode="4.5" ... />

in your web.config, values will only get validated when you access them. This is called deferred validation.

Also you can get unvalidated values via

var s = context.Request.Unvalidated.Form["forum_post"];

Answer 3

You can disable it for the entire application by editing the web.config file

<configuration>
   <system.web>
      <pages validateRequest="false" />
   </system.web>
</configuration>

It would help to know if you want to just suppress the error, or if you want to prevent it from being raised to start with. If you want to prevent it, sanitize your input (using javascript or validators) before submitting the form.

Answer 4

Yep, you can do it globally in the web.config.

If you're running .net 4.0 you can add this into your web.config

<httpRuntime requestValidationMode="2.0"/>

Or you could add this instead

<pages validateRequest="false" />