Question

I need send html. I get error(this machine transalate):

Detected a potentially dangerous value of Request.Form, received from
the client (Description = “eqqdaqd asda

Description: The procedure of verification requests found potentially
dangerous client input value, the query processing is interrupted.
This value may indicate an attempt to compromise the security of
applications, such as attacks by “cross-site scripting”. To allow
pages override default scan request an application, see httpRuntime
configuration attribute to set the requestValidationMode
requestValidationMode = “2.0”. Example: . After setting this value, you can
disable request validation by setting validateRequest = “false” in the
Page directive or the configuration section . However, in this
case are urged in the application explicitly check all the entries.
For more information, see
http://go.microsoft.com/fwlink/?LinkId=153133.

 public ActionResult Create()
        {
            this.ValidateRequest = false;
            return View();
        }

        //
        // POST: /Admin/News/Create

        [HttpPost]
        public ActionResult Create(NewsView model)
        {
            this.ValidateRequest = false;
            try
            {
               //logic

                return RedirectToAction("Index");
            }
            catch
            {
                return View();
            }
        }

This controller is in the arena admin. I set in web.config

<system.web>
    <httpRuntime requestValidationMode="2.0" />

Answer 1

You could decorate your controller action with the ValidateInput attribute:

[HttpPost]
[ValidateInput(false)]
public ActionResult Create(NewsView model)
{
    ...
}

In your example you are setting the property inside the POST controller action but that’s too late because validation is performed before invoking the action. Or if you want to disable validation only for a given property on your view model you could decorate it with the AllowHtml attribute:

[AllowHtml]
public string Description { get; set; }

Now you no longer need to decorate the controller action with the ValidateInput attribute.