Home/ Questions/Q 4101506
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-20T20:42:22+00:00

I’m writing a hello world example using ASP.net MVC 2 framework with two text

  • 0

I’m writing a hello world example using ASP.net MVC 2 framework with two text boxes for username and password field.

    <form action=/Home/Index method="post">
        <input type="text" id="UserName" name="UserName" maxlength="100" tabindex="1" autocomplete="off"/>
        <input type="password" id="Password" name="Password" maxlength="15" tabindex="2" autocomplete="off"/>
        <input type="submit" value="submit" />
    </form>

When I input into username field, I get this message

A potentially dangerous Request.Form value was detected from the client (Email=”
Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. To allow pages to override application request validation settings, set the requestValidationMode attribute in the httpRuntime configuration section to requestValidationMode=”2.0″. Example: . After setting this value, you can then disable request validation by setting validateRequest=”false” in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case. For more information, see http://go.microsoft.com/fwlink/?LinkId=153133.

Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (Email=”

Someone please tell me how to fix it, it appears sending request is not redirected to my controller yet.
Thank you much!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    A few pointers:

    First try running the site as as .NET 2.0 rather than 4.0. Are you using IISExpress? If so there is a switch to set the CLR to version 2. see here:

    http://learn.iis.net/page.aspx/870/running-iis-express-from-the-command-line/

    Next the system will always look for HTML chars in the posted data as this is an indication of cross site scripting attacks. If you expect these values to contain HTML chars then you can add an exception on the controller action like so:

    [ValidateInput(false)]
public ActionResult ActionName(ModelType model)
{
   ....

  return View();
}
    • 0