Validaterequest in the web. config file of SharePoint

This is an attribute of pages in Web. config.

Location in

<Configuration>

<System. Web>

<Pages validaterequest = "false">

</Pages>

</System. Web>

<Configuration>

 

Starting from. NET Framework 1.1, the default value of this element is true. In machine. config, the default value is true.

This element can be used to prevent script injection attacks (script-injection attacks), that is, the client script or HTML can be sent to the server in an unknown situation. if this value is set to false, your applicationProgramThere are risks, details refer to http://support.microsoft.com/kb/821343.

 

Some applications set the validate request attribute to false, so the application itself should handle and prevent script injection attacks. For details, see the following two articles.Article.

Http://msdn.microsoft.com/en-us/library/950xf363 (vs.71). aspx

Http://technet.microsoft.com/en-us/library/cc262849.aspx#section12

 

As you can see in Web. config of a new SharePoint web application, the value is false.

Because the validate request option organizes XML tags (<A-Z, <!, </, & #, <? And SharePoint requests require these tags to describe caml queries, or implement Rich Text Editor and other functions.

Therefore, the value of the SharePoint validate request option is false. Do not modify it.