ASP.net MVC 2 how do I handle A potentially dangerous Request.Form value was detected from the client

Question

I have been browsing the web and stackoverflow trying to figure out how to handle this error.

A potentially dangerous Request.Form value was detected from the client

The error occurs when a user enters in html or xml tags( < p> or < HeyImXML>) and tries to submit a form. The input is not suppose to contain any sort of markup at all, just plain text.

I am using asp.net MVC 2.0 and I'm using model binding validation as well as Html.EnableClientValidation. These work fine as long as there is no markup entered. I was wondering what is the best approach on how to avoid this error page.

My guess is to write a new validation class which checks for this kind of markup?

Clarification:

I want to catch the error in this specific instance. To clarify there is an area with a form for siteadmins that can enter markup and there is a normal users area where they can not enter markup. However this error page appears when a normal users enters markup. My question is, how do I handle this to prevent the site from crashing and showing the error page. I want to display a cleaner error without a site crash.

Answer 1

This was introduced early on in ASP.Net to try to help prevent script injection attacks. It isn't unique to MVC.

If you don't want this feature, you can turn it off and write your own.

To disable request validation on a page, set the validateRequest attribute of the Page directive to false:

<%@ Page validateRequest="false" %>

To disable request validation for your application, modify Web.config - set the validateRequest attribute of the <pages /> section to false:

<configuration> 
    <system.web> 
        <pages validateRequest="false" /> 
    </system.web> 
</configuration>