ValidateRequest=“false” not worked

Question

I need send html. I get error(this machine transalate):

Detected a potentially dangerous value of Request.Form, received from the client (Description = "eqqdaqd asda
Description: The procedure of verification requests found potentially dangerous client input value, the query processing is interrupted. This value may indicate an attempt to compromise the security of applications, such as attacks by "cross-site scripting". To allow pages override default scan request an application, see httpRuntime configuration attribute to set the requestValidationMode requestValidationMode = "2.0". Example: . After setting this value, you can disable request validation by setting validateRequest = "false" in the Page directive or the configuration section . However, in this case are urged in the application explicitly check all the entries. For more information, see http://go.microsoft.com/fwlink/?LinkId=153133.

 public ActionResult Create()
        {
            this.ValidateRequest = false;
            return View();
        }

        //
        // POST: /Admin/News/Create

        [HttpPost]
        public ActionResult Create(NewsView model)
        {
            this.ValidateRequest = false;
            try
            {
               //logic

                return RedirectToAction("Index");
            }
            catch
            {
                return View();
            }
        }

This controller is in the arena admin. I set in web.config

<system.web>
    <httpRuntime requestValidationMode="2.0" />

Darin Dimitrov Darin Dimitrov · Accepted Answer · 2012-05-22T09:27:17

You could decorate your controller action with the ValidateInput attribute:

[HttpPost]
[ValidateInput(false)]
public ActionResult Create(NewsView model)
{
    ...
}

In your example you are setting the property inside the POST controller action but that's too late because validation is performed before invoking the action. Or if you want to disable validation only for a given property on your view model you could decorate it with the AllowHtml attribute:

[AllowHtml]
public string Description { get; set; }

Now you no longer need to decorate the controller action with the ValidateInput attribute.

ValidateRequest=“false” not worked

2 Answers