Question

My ASP.NET page contains “ValidateRequest = true”. However, there is one textbox in the page for which I don’t want ASP.NET to validate. Is there a way to make it false for that one control? If there isn’t, is there a way to ignore the “Potential Threat” error, assuming it comes from that particular control?

Thanks

Answer 1

The only way I know of to do this would be to call the ValidateString of the HttpRequest class. Unfortunately, it is private, so you have to do it with reflection.

I have not tested this – it is not exactly the same code I use. it is adapted from code I wrote a few years ago, so maybe Microsoft has something new which make this easier.

MethodInfo _validateMethodInfo = typeof(HttpRequest).GetMethod("ValidateString", BindingFlags.NonPublic | BindingFlags.Static | BindingFlags.InvokeMethod);
foreach (string key in Request.Form.AllKeys) {
  if (key = "< skipped field name >") {
    continue;
  }
  object[] parameters = { Request.Form[key], key, "Request.Form" };
  _validateMethodInfo.Invoke(Request, parameters);
}