i have a login view in asp.net-mvc. i want that user cannot able to enter tag in username or password field
A:
Is there some reason regular sanitisation approaches As described here will not work with MVC?
glenatron
2010-06-01 14:00:59
+2
A:
Why would you want preventing the user from entering tags? Leave him enter whatever he wants. Why preventing someone from having a password such as <script>alert('hello');</script> - it looks like a pretty strong password. Personally I hate web sites limiting my choices for a password.
Just make sure that you encode everything you are outputting inside the views:
So instead of:
<div>Hello <%= Model.Username %></div>
Always use:
<div>Hello <%= Html.Encode(Model.Username) %></div>
or:
<div>Hello <%: Model.Username %></div>
if you are working with ASP.NET 4.0
Also, as pointed out by @Jab in the comments section, in order to accept such input from the user you might need to decorate the controller action that will handle the submission with the [ValidateInput(false)] attribute.
Darin Dimitrov
2010-06-01 16:07:04
To accept input of <script> tags you will have to use [ValidateInput(false)] on any screen where the user inputs the password. Otherwise you get the YSOD.
Jab
2010-06-01 17:23:54
@Jab, good point about the `ValidateInputAttribute`.
Darin Dimitrov
2010-06-01 17:55:09
@Darin: Html.Encode(Model.UserName) is working fine when im trying to display UserName but whenever a user try to login and enter <script>alert("asdf")</script> in username textbox yellow screen comes which says "A potentially dangerous Request.Form value was detected from the client (username="<script>alert("asdf"...")" I have try [ValidateInput(false)] but it doesnt work
Fraz Sundal
2010-06-02 06:01:32
You need to put it on the controller action to which you are posting: http://davidhayden.com/blog/dave/archive/2009/04/08/ValidateInputAttributeASPNETMVCPotentiallyDangerousRequestFormValues.aspx
Darin Dimitrov
2010-06-02 06:18:00
Thanks Darin but i have tried this and its not working in my case
Fraz Sundal
2010-06-02 06:40:23