MVC: A workaround for detecting potentially dangerous request.form values from the client

error message: A potentially dangerous request.form value was detected from the client (content= "<em ><strong ><u > This is the test ...").

Description: The request verification process detected a potentially dangerous client input value and the processing of the request has been aborted. This value may indicate an attempt to compromise application security, such as a cross-site scripting attack. To allow the page rewrite application to request validation settings, set the Requestvalidationmode attribute in the HttpRuntime configuration section to requestvalidationmode= "2.0". Example: However, in this case, it is strongly recommended that the application explicitly check all inputs. For more information, see http://go.microsoft.com/fwlink/?LinkId=153133.

Workaround:

1, validaterequest= "false" is added to the page in which the error occurred, and any post submission for that page will no longer verify the security of the submission.

<%@ page title="" language="C #" masterpagefile="~/views/manage /viewmasterpageedit.master" inherits="system.web.mvc.viewpage< MvcWebPhoto.Models.Entities.Article >" validaterequest="false" % >

2, configure validaterequest= "false" in the Pages section in Web. config.

<system.web >    <pages validaterequest="false" ></pages > </system.web >

However, all form requests throughout the project no longer verify the security of the submissions, and this practice is highly discouraged.

3, if you are using. Net 3.5,MVC 2.0 and later, you can add an attribute to the action that handles the POST method: [ValidateInput (false)], so that the processing is more targeted, improve the security of the page.

[Httppost][validateinput (false)]  Public ActionResult Catalogedit (Catalog model) {    return  View ();}

If you are using MVC 3.0 or later, you will find that the above settings are not valid. This is because you also need to make the following settings in Web. config:

<system.web >    "2.0" /></ system.web >

Note : In an MVC project, under the Views folder and under the main project, there will be a Web. config file. The Web. config file under Views is only valid for files below the Views folder. If the page you are dealing with is not under views, then

Original address: http://www.cnblogs.com/scgw/p/3602380.html

MVC: A workaround for detecting potentially dangerous request.form values from the client