Disable request verification in ASP. NET MVC

By default, the ASP. net mvc framework prohibits users from submitting potentially dangerous content. For example, if HTML content is entered in a text input box, an error similar to the following is reported:

A potentially dangerous Request. Form value is detected from the client (TextBox1 = "<a> </a>.

This function can reduce the possibility of script attacks, but sometimes it is necessary to allow the user to input HTML content, such as publishing an article, and to disable the request verification function. At this time, write on the page:

ASPX code
<% @ Page ValidateRequest = "false" %>
This command is invalid and cannot be set in web. config. In MVC, if you want to disable request verification, you need the [ValidateInput] attribute. For example:

C # code
[ValidateInput (false)]
[AcceptVerbs (HttpVerbs. Post)]
Public ActionResult Create ([Bind (Exclude = "Id")] Product productToCreate)
{
If (! ModelState. IsValid)
Return View ();

_ DataModel. AddToProductSet (productToCreate );
_ DataModel. SaveChanges ();
Return RedirectToAction ("Index ");
}
 

 

Author: Meng xianhui