Validaterequest in ASP.net

This attribute is used to verify the input of the client user and verify whether there are any dangerous characters in the user input. The default value of this attribute is true, microsoft is doing this to improve the security of the Asp.net program. Therefore, many programmers, even if they do not know how to defend themselves against hacker attacks, have controlled the security of some default attributes of Asp.net, this is why the Asp.net program is relatively secure!
Since the default value of this attribute is true, and the Asp.net page is frequently resent, if there is no user interaction, Will Asp.net be strictly adjusted every time, in this way, the execution time of the system may be lost. As for: If there is no client interaction, Will Asp.net verify that this is a problem for Microsoft engineers? For us, if there is no client interaction, I feel that this attribute should be set to false, so no matter how Microsoft engineers design it, it has no impact on our program itself!
The method to directly disable this attribute is:
1. Write "validaterequest =" false "in the attributes of the ASPX page ""
2. Set <configuration> in Web. config.
<System. Web>
<Pages validaterequest = "false"/>

</System. Web>
</Configuration>

However, when users need to interact with each other, we need to use its default value. However, things may not be as simple as we think, nor perfect, when you use some HTML editors So that programmers must disable the validaterequest attribute. What should we do to control the security performance of the asp.net page?
Of course, we can filter all dangerous characters in this area, which may improve security, but we prevent omissions in user input, this leads to security issues. In turn, we can consider how many special characters we need to submit and then escape or replace the special characters we have submitted, in this way, we can set the validaterequest attribute to true, which not only solves the security problem of the program but also meets our needs!
Sometimes, when interacting with users, users may inevitably enter special characters, because the value of validaterequest we set is true, so the page will not give any prompt, directly output a large page of error information, which may lead to users' misunderstanding. They may think that the website is faulty and the user cannot think that he has entered invalid characters! What should we do in this case?
The answer is that Page_Error can be used to handle events: protected void Page_Error (object sender, EventArgs e)
{
Exception ex = Server. GetLastError ();
If (ex is HttpRequestValidationException)
{
Response. Write ("the characters you entered have invalid characters! ");
Server. ClearError ();
}
}

1. Its namespace is system. Web. configuration.
2. Assembly: system. Web (in system. Web. dll)
3. Class: pagesSection

The method for disabling this attribute in the latest MVC mode is as follows (super simple): [ValidateInput (false)]
Public ActionResult Index ()
{
Return View ();
}