Trapping ValidateInput

Question

If I have a search box on my page I clearly do not want the user to input any code that may be dangerous.

However, I have a lot of data entry pages and each one needs to have ValidateInput(false) on the controllers.

I don't want to allow dangerous input, but I also don't want to handle this in each and every controller.

Is there a way that the default, and ugly, error .Net error message can be overwritten, or is there a uniform way of handling this across controllers.

EDIT

I think maybe I didn't ask the question correctly.

For every data entry page I have I have to turn of Input Validation. This becomes somewhat boring and cumbersome. Each time I accept input I need to HTMLEncode and then HTMLDecode later.

Is there a way to do this in one central place and automatically?

Answer 1

ASP.NET and MVC don't allow HTML submissions by default. You have to actively enable this. See the ValidateInputAttribute for more information.

Also, even more important than not allowing HTML input is not displaying user submitted HTML when you create output. That's why all of the default generated views use Html.Encode, and why you should, too.

Update in response to edited question

Yes, it's possible (though probably not advisable) to turn off ValidateInput globally. Make a parent controller type, and put

[ValidateInput(false)]

...on the class.

Also, I don't recommend encoding input. If you allow users to input HTML, I'd store that as-is. Your web app might not be the only thing which queries your DB! In terms of filtering out "dangerous" HTML, that's extraordinarily difficult. I'd use a tested, third-party sanitization library.

Answer 2

About output:

Here's an interesting post.
And another one from Steve Sanderson.

I just read that post some time ago - haven't tried myself.

Give some feedback how it turns out.

About input:
you could try to mess around with model binder and HtmlEncode values it takes.