Question

I’m trying to work on a ‘practice’ app wherein the textbox value will be inserted to the database.

What happen is that when I insert the textbox.text value.

Ex. text =

           <script>alert('Hello')</script>

I get an error: A potentially dangerous Request.Form value was detected from the client (TextBox1=”alert(‘XSS’)…”).

I’m already using sql parameters so values like ‘ ” /// \\ are not a problem as of now.

Answer 1

Set ValidateRequest=”false” for your page, for allowing html.

At page level:

<%@ Page Language="c#"  ValidateRequest="false" AutoEventWireup="false" CodeBehind="TestPage.aspx.cs" Inherits="TestPage" %>

Also, for ASP.NET 4.0, you need to add the following to your web.config:

<httpRuntime requestValidationMode="2.0" />