A potentially dangerous Request.Form value in MVC 2 & ASP.NET 4.0

Question

When I trying to send form containing value with xml, I get HttpRequestValidationException:

A potentially dangerous Request.Form value was detected from the client

All approaches I found:

1. <%@ Page ValidateRequest="false" %> in .aspx-file.
2. <pages validateRequest="false" /> in web.config.
3. [ValidateInput(false)] on controller's action.

don't help me.

Hope for any advice.

Answer 1

This is a documented breaking change in ASP.NET 4. See this whitepaper for more information. In short, add this to ~\Web.config:

<httpRuntime requestValidationMode="2.0" />

And remember to put [ValidateInput(false)] on controllers / actions you don't want to go through validation.

Answer 2

Is there any way to handle this without go back to 2.0?

Answer 3

I Applied all the above but still I'm getting the same error.I'm using asp.net web forms 4.0

Answer 4

Does it matter where exactly I paste this line:

<httpRuntime requestValidationMode="2.0" />

If it does, where should it be?

Answer 5

Same problem using UrlEncoding for a search url. Server.UrlEncoding() adds plus (+) sign to string spaces. Strangely works, with the same settings on my local IIS (on Windows 7 X64). The server is Windows 2008 x64 with IIS 7.0.