how can we prevent special tag inserted into textbox ? in asp.net

Question

Is there any property or any function is giving which is prevent above issue..

i made a one register form.. and my friend inserted tag into username.. and it will raise a error at server side.. i tried to prevent it. with validation but.. it cant..

i did it.. check out this line..

txt_countryname.Text = HttpUtility.HtmlEncode(txt_countryname.Text);

but its not working ... – Sikender 0 secs ago [delete this comment]

help me...

Answer 1

Server.HtmlEncode

Answer 2

I would take a look at HttpServerUtility.HtmlEncode.

Answer 3

There is a good reason for this behavior - to avoid cross site scripting attacks.

It can be disabled by adding this to your web.config:

<configuration>
    <system.web>  
        <pages validateRequest="false" />
    </system.web> 
</configuration>

Read through this article to find out why disabling request validation is a bad idea.

As CodeMonkey noted, you can also do this on a single page basis in the @page directive:

<%@ Page validateRequest="false" %>

Which would be a better approach, by not exposing all of your pages to xss.

Answer 4

you also can use asp:RegularExpressionValidator Example:

<asp:TextBox ID="txt_username" runat="server"></asp:TextBox>
<asp:RegularExpressionValidator ID="RegularExpressionValidator1" runat="server" Text="Error" ErrorMessage="some error message" ValidationExpression="^[a-zA-Z0-9]+[a-zA-Z0-9]{4,15}$" SetFocusOnError="True" ControlToValidate="txt_username">

Answer 5

You will want to, for that page to disable Script-validation. The reason why you are getting that error is because ASP.NET by default validates incoming posts.

Read more about it