views:

36

answers:

2

There is one more parameter to send with the request.

So this is my code so far:

   $.post(url + "/SaveProfile", { xml: XML, configName: name}, function() {
      alert("Saved");
   });

I got this error :

A potentially dangerous Request.Form value was detected from the client

+1  A: 

A potentially dangerous Request.Form value was detected from the client

That is the serverside framework protecting you from people trying to do injections. There are ways to disable that for the page or for the entire site [I would not recommend doing that.] Easiest thing to do to get around it is to encode the string and unencode it on the server.

epascarello
Should I prefer POST over GET in this case ?
POST is probably better if the xml is going to be over the limit of get in IE.
epascarello
+1  A: 

It's a server feature to protect against injection attacks.

If you're using ASP.NET MVC, you can use the ValidateInput attribute to decorate the controller receiving your XML data:

[ValidateInput(false)]
[AcceptVerbs (HttpVerbs.Post)]
public ActionResult
SaveEdits (string xmlData)
{
     ....
}

If you're using classic ASP.NET, use the directive in your .aspx page (not recommended, might open security issues):

<%@ Page ValidateRequest="false" ... %>

axel_c
Yes,but turning it off isn't a save choise.
It is, if you turn it off only where you need it and you validate the data properly yourself.
axel_c