views:

53

answers:

2

My ASP.NET page has an <asp:TextBox /> whose text input is encoded via HttpUtility.HtmlEncode();

The page also contains validators such as <asp:RequiredFieldValidator /> and <asp:CustomValidator /> as well as several AJAX toolkit <toolkit:ValidatorCalloutExtender />

If the user inputs </ as the text in the textbox, a Javascript error

A potentially dangerous Request.Form value was detected
from the client (ctl00$contentPlaceHolder$ucLookup$tbxLastName=&quot;&lt;/&quot;)

happens when the form is submitted. I have tried adding various event handlers such as

protected void Page_PreInit(object sender, EventArgs e){}
protected void Page_Init(object sender, EventArgs e){}
protected void Page_PreLoad(object sender, EventArgs e){}

and setting breakpoints but none of them are hit, leading me to believe the error only happens client-side.

How can I debug this error? Are there any hooks which allow me to intercept the user's input and filter or encode it before it causes this issue?

+1  A: 

Try checking out the suggestions in this thread: A potentially dangerous Request.Form value was detected from the client

Mike Hofer
A: 

For this Potentially dangerous error, you can do the following and see if it helps -

Add the line: <pages validateRequest="false" /> inside the <system.web> section

Sachin Shanbhag
Per a comment above, is there a way to do this without setting validateRequest="false"? Is there a hook that fires before the validation occurs that I can intercept?
Alex