views:

44

answers:

2

I put ValidateRequest="false" in my page directive but the page acts like it's not posting back. If I remove the html then it posts back fine.

Using the text boxes inside an update panel shouldn't make a difference right?

I'm trying to store text in my database with html formatting.

Again, I am using an update panel.

A: 

Apparently you need to put <httpRuntime requestValidationMode="2.0" /> in web.config to be able to use the ValidateRequest feature in the page directive.

nick
+3  A: 

You're probably getting an error behind the scenes. If you take out the update panel do you see a nice YSOD?

If this is a .Net 4.0 application, you'll need to change the web config in order to allow for unsafe characters, even though you turned ValidateRequest to false.

The requisite change looks like this: <httpRuntime requestValidationMode="2.0" />

Eric
yep i took out the update panels and then got the ysod. Thanks.
nick
+1. This is a diabolical change, requiring you to opt-out in two different places just to shake off a feature that is totally wrong-headed, can't make an insecure application secure, and only gives an application that's already secure a load of bugs.
bobince