I’m sending post with html to controller, and get exception in Chrome:
Failed to load resource: the server responded with a status of 500 (Internal Server Error)
.net 4.0, webserver is webdev at vs2010 my config:
<system.web>
<compilation debug="true" targetFramework="4.0">
<assemblies>
<add assembly="System.Web.Abstractions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
<add assembly="System.Web.Routing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
<add assembly="System.Web.Mvc, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/>
<add assembly="System.Web.DataVisualization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35"/></assemblies>
</compilation>
<httpRuntime requestValidationMode="2.0" />
<pages validateRequest="false">
<namespaces>
<add namespace="System.Web.Mvc"/>
<add namespace="System.Web.Mvc.Ajax"/>
<add namespace="System.Web.Mvc.Html"/>
<add namespace="System.Web.Routing"/>
</namespaces>
</pages>
…
what am i missing?
You need to set
[ValidateInput(false)]on the Controller Action that you want to allow HTML for. (Or on the entire controller, but that’s bad practice.The other important thing is one that you got already,
<httpRuntime requestValidationMode="2.0" />in the web.config.Setting RequestValidate in the .aspx files or web.config does not work in MVC as it’s the controller, not the View that does request validation.
Edit: In the meantime, MVC 3 was released. This allows you to decorate individual properties of your model with [AllowHtml] to make them safe without completely disabling Request Validation.