views:

226

answers:

3

Hello, I'm using a rich text editor in my asp.net mvc form (nicedit with a textarea) and when I submit the form on post, because it is not html encoded I get the following message: "A potentially dangerous Request.Form value was detected from the client" . How can I html encode the textarea on post ? I don't want to cancel the validation. Is there a way to use the html.encode helper on submit?

Thank you.

+1  A: 

You could decorate the action handling the form post with the ValidateInputAttribute:

[ValidateInput(false)]
[HttpPost]
public ActionResult SomeActionToHandleFormSubmission() 
{
    ...
}
Darin Dimitrov
thank you for your answer, but i don't want to cancel the validation. I want to encode it before submit. anyway even when i put the attribute it still gives me the server error.
Gidon
Even when the post is encoded, ASP.NET may fire this exception since it's designed to prevent users from posting dangerous content that you then display back to other users. Since you will almost certainly Decode it before displaying, ASP.NET must validate the decoded content for the protection to be of any value. Bu adding the ValidateInput attribute to the _POST_ action method you tell ASP.NET that you know what you are doing and will take the appropriate measures to ensure that the submitted content is safe.
Paul Alexander
What are the appropriate measures which I need to take to ensure that the submitted content is safe?
Gidon
Safe for what? When you are going to render the text entered by the user just pass it through `Html.Encode`.
Darin Dimitrov
A: 

Are you using .net 4.0? If so you will also need

<system.web>' 
<httpRuntime requestValidationMode="2.0"/>'

in your config.web file.

Tony Bolding
This disables validation for the entire site which probably isn't the best practice. @Darin's answer is the correct way to disable validation in an MVC environment.
Paul Alexander
Paul - trouble is @Darin's answer is incomplete for .net 4
Tony Bolding