In this article I will explain, how to resolve the error
A potentially dangerous Request.Form value was detected from the client in
ASP.Net.
The error exception A potentially dangerous Request.Form value was detected from the client occurs when
ValidateRequest is set true and someone tries to submit
HTML content to server example
Hello. This error comes since
ASP.Net tries to protect the application from Script Attacks.
Error
The following error occurs when you try to submit
HTML content to server.
Server Error in 'ASP.Net' Application
A potentially dangerous Request.Form value was detected from the client (TextBox1"=<p>Hello</p>").
Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. You can disable request validation by setting validateRequest=false in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case.
Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (TextBox1="=<p>Hello</p>").
Cause
By default, all input controls in
ASP.Net are validated for potentially unsafe contents that can lead to
Cross Site Scripting and
SQL Injection attacks.
The ValidateRequest setting which by default is TRUE disallows malicious content by throwing the above Exception.
Hence it is recommended to allow the
ValidateRequest setting to TRUE so that validation is performed on each Request in
ASP.Net.
Solution
For such cases the above exception can be suppressed by setting the ValidateRequest to FALSE in the following ways.
1. At Page level using @Page Directive [RECOMMENDED]
The ValidateRequest setting can be set to FALSE in the @Page Directive. Disabling the ValidateRequest setting in @Page Directive will disable it only for the specific Page.
This will disable the validation of requests for the page you have set the ValidateRequest setting to FALSE.
<%@ Page Language="C#" AutoEventWireup="true" ValidateRequest="false"%>
2. In Web.Config
The
ValidateRequest setting can be disabled for complete application by setting it to FALSE in the
System.Web section of
Web.Config as shown below.
<pages validateRequest= "false" />
For .Net 4.0 or higher frameworks, the following setting also needs to be added along with the above setting in the
System.Web section of
Web.Config.
<httpRuntime requestValidationMode= "2.0" />
