Add validateRequest = false but still getting the error

Question

Hi,

I added:

<pages validateRequest="false">

to my web.config but I am still getting the error:

A potentially dangerous Request.Form value was detected from the

I added it to the view page also and still getting the error.

How can this be?

Answer 1

In MVC, request validation has to be done at the controller level instead of at the page level because the controller is processing input, not the page. If request validation were done at the page level, then the controller would happily process malicious input (and potentially commit it to the database!) before the validation check ever took place.

[ValidateInput(false)]