Question

I’m attempting to circumvent the error message that .NET throws when you try and submit HTML:

A potentially dangerous Request.Form value was detected from the client

Having read the following question, web.config looks like this:

<configuration>
    <system.web>

        <httpRuntime requestValidationMode="2.0" requestPathInvalidCharacters=""/>

        <pages validateRequest="false">
            <namespaces>
                <add namespace="Microsoft.Web.Mvc" />
                <add namespace="System.Web.Mvc" />
                <add namespace="System.Web.Mvc.Ajax" />
                <add namespace="System.Web.Mvc.Html" />
                <add namespace="System.Web.Routing" />
            </namespaces>
        </pages>

    </system.web>
</configuration>

When I type in HTML, I’m still getting the error though. I’m running a .NET 4, MVC 2 application just using the Visual Studio development server.

Answer 1

Ahh, just read a blog here: http://geekswithblogs.net/renso/archive/2011/08/26/a-potentially-dangerous-request-value-was-detected-from-the-client.aspx

It talks of adding another attribute on your actions, [ValidateInput(false)], which funnily enough, I haven’t seen mentioned on any of the similar questions on SO.

I added the attribute to my BaseController, of which all controllers in my application inherit from and it immediately started working.

[ValidateInput(false)]
public class BaseController : Controller
{
    // code here
}

Note: I still needed to include both:

<httpRuntime requestValidationMode="2.0"/>

and

<pages validateRequest="false" />

in the web config.