Question

I’m currently working on a web application in ASP.NET that displays reports (created with SQL Sever BIDS) that grab data from a SQL Server database. Code-behind is in C#. I’m doing some security testing by sending HTML injections in the report parameters (just a couple tags will do it, e.g. <i>text</i>). After I click “View Report” it churns for about half a second and then throws the following error:

Microsoft JScript runtime error: Sys.WebForms.PageRequestManagerParserErrorException: The message received from the server could not be parsed.

The call stack is all anonymous Javascript functions. I didn’t write some of the underlying code in this project so I’m having trouble figuring out how to catch the error—before it gets sent to the server, if that’s possible.

Answer 1

Solved via adding the following Javascript code directly below (not inside) the ReportViewer tag:

    <script type="text/javascript">
        $("input").blur(function () {
            ClientValidate(this);
        });
    </script>

where ClientValidate() is a function that strips HTML tags via regular expression.