failed to fix: A potentially dangerous Request.Form value was detected from the client

Question

When I try to add a text like <p>example</p> to Product_Text cell of a product in Tbl_Product, I receive this message: A potentially dangerous Request.Form value was detected from the client.

Although I put <httpRuntime requestValidationMode="2.0" /> and <pages validateRequest="false" /> to <system.web> in web.config, I am continuing to receive the error message.

have you tried setting the attribute to the property or Action method? https://stackoverflow.com/a/17258129/814352 — CodingSlayer, Sep 12 '19 at 19:18
Including Validate="false" at the top of my webforms aspx page fixed the problem for me. — Andrew Reese, Sep 26 '19 at 19:04

shaunteezie · Accepted Answer · 2019-09-13T03:07:01.123

0

You need to use HtmlEncode when inserting html into the database. So something like:

var productText = Server.HtmlEncode("<p>example</p>");

in your code behind should work.

edited Sep 13 '19 at 03:07

answered Sep 12 '19 at 22:20

shaunteezie

99
2

this looks like a solution. – Arya Sep 14 '19 at 11:15
1

That error should have absolutely nothing to do with encoding the HTML when inserting into the database since that error happens on the form submit, NOT internally when saving to the DB. – Charles Boyung Jan 05 '22 at 21:22

score 0 · Answer 2 · answered May 25 '23 at 03:51

You can also use this:

On the server side, you can use this:

Create a hidden field in asp.net and encode it.

hiddenFieldMessage.Value = Uri.EscapeDataString(dangerousString);

Then in Javascript, create a text area and decode the encoded value.

<script>
    (function () {
        
        const content = document.getElementById('<%= hiddenFieldMessage.ClientID %>').value;
        // decode the content back to html
        var textArea = document.createElement("textarea");
        textArea.innerHTML = decodeURIComponent(document.getElementById('<%= hiddenFieldMessage.ClientID %>').value);
        const content = textArea.value;  // decoded value
   })

failed to fix: A potentially dangerous Request.Form value was detected from the client

2 Answers2