RESOLUTION
The request validation feature of ASP.NET 1.1 prevents the
server from accepting content that contains unencoded HTML. You can disable
request validation by setting the
validateRequest attribute to
false in the
@ Page directive or in the configuration section.
Disable Request Validation on a Page
To disable request validation on a page, you must set the
validateRequest attribute of the
@ Page directive to
false:
<%@ Page validateRequest="false" %>
Note When request validation is disabled, content is submitted to a
page. The page developer must make sure that the content is correctly encoded
or is correctly processed.
Disable Request Validation for Your Application
To disable request validation for your application, you must
modify or create a Web.config file for your application and then set the
validateRequest attribute of the <PAGES /> section to
false:
<configuration>
<system.web>
<pages validateRequest="false" />
</system.web>
</configuration> If you want to disable request validation for all applications on your
server, you can make this change to your Machine.config file.
Note When request validation is disabled, content is submitted to your
application. The application developer must make sure that the content is
correctly encoded or is correctly processed.
HTML Encode the Content
When request validation is disabled, you must HTML encode the
content to prevent possible attacks by unencoded HTML content.
If
you have disabled request validation, it is good practice to HTML encode
content that will be stored for future use. HTML encoding automatically
replaces any "<" or ">" characters (and several other symbols) with their
corresponding HTML encoded representation.
You can easily HTML encode
content on the server by using the
Server.HtmlEncode(String) method. You can also easily HTML decode content. HTML decoding
reverts HTML-encoded content back to standard HTML. To do this, use the
Server.HtmlDecode(String) method.
Use the following code:
Microsoft Visual Basic. NET Code
<%@ Page Language="vb" validateRequet="false" %>
<HTML>
<HEAD>
<title>WebForm2</title>
<script runat="server">
Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs)
' Set the label to the HTMLEnoded value of TextBox.
Label1.Text = Server.HtmlEncode(TextBox1.Text)
End Sub
</script>
</HEAD>
<body>
<form id="Form1" method="post" runat="server">
<asp:Button id="Button1" OnClick="Button1_Click"
style="Z-INDEX: 101; LEFT: 299px; POSITION: absolute; TOP: 172px" runat="server" Text="Button">
</asp:Button>
<asp:Label id="Label1"
style="Z-INDEX: 102; LEFT: 403px; POSITION: absolute; TOP: 171px" runat="server">Label
</asp:Label>
<asp:TextBox id="TextBox1"
style="Z-INDEX: 103; LEFT: 248px; POSITION: absolute; TOP: 122px" runat="server">
</asp:TextBox>
</form>
</body>
</HTML>
Microsoft Visual C# .NET Code
<%@ Page Language="c#" validateRequet="false" %>
<HTML>
<HEAD>
<title>WebForm2</title>
<script runat="server">
private void Button1_Click(object sender, System.EventArgs e)
{
// Set the label to the HTMLEnoded value of TextBox.
Label1.Text = Server.HtmlEncode(TextBox1.Text);
}
</script>
</HEAD>
<body>
<form id="Form1" method="post" runat="server">
<asp:Button id="Button1" OnClick="Button1_Click"
style="Z-INDEX: 101; LEFT: 299px; POSITION: absolute; TOP: 172px" runat="server" Text="Button">
</asp:Button>
<asp:Label id="Label1"
style="Z-INDEX: 102; LEFT: 403px; POSITION: absolute; TOP: 171px" runat="server">Label
</asp:Label>
<asp:TextBox id="TextBox1"
style="Z-INDEX: 103; LEFT: 248px; POSITION: absolute; TOP: 122px" runat="server">
</asp:TextBox>
</form>
</body>
</HTML>