Question

I have created a textbox for my users to enter their comments. So, sometimes they copy the error that has been raised in the application and paste in the textbox along with comments. It may include illegal characters (eg. </11>) but it should be saved but my .aspx is not allowing. I don’t know how to handle this. thanks!

Answer 1

If you want user to edit TextBox and enter html tags you can disable this via

 <%@ Page validateRequest="false" ...>

or in the web.config for your entire application:

<system.web>
  <page validateRequest="false" />
</system.web>

Note that this ValidateRequest property is not existing without
reason. When you change its default value, insecure input will be
accepted. Because of that, you need to validate every user’s input to
avoid cross-site scripting attacks, like inserting of malicious
JavaScript, ActiveX, Flash or HTML

---

Another smart solution is to replace via javascript text written by user to make it safe for validation.
< anyword> , instead of <anyword> is considered safe!

function validateTxt() {
    $("textarea, input[type='text']").change(function () {
      html = $(this).val(); //get the value
      //.replace("a" , "b")  works only on first occurrence of "a"
      html = html.replace(/< /g, "<"); //before: if there's space after < remove
      html = html.replace(/</g, "< "); // add space after <
      $(this).val(html); //set new value
   });
}

$(document).ready(function () {
      validateTxt();
});