Why is ValidateInput(False) not working?

asp.net-mvc vb.net tinymce request.form
Dekryptid picture Dekryptid · Apr 30, 2009 · Viewed 38.3k times · Source

I am converting an application I created using webforms to the asp.net mvc framework using vb.net. I have a problem with one of my views. I get the yellow screen of death saying "A potentially dangerous Request.Form value was detected from the client" when I submit my form. I am using tinymce as my RTE. I have set on the view itself

ValidateRequest="false"

I know that in MVC it doesn't respect it on the view from what I've read so far. So I put it on the controller action as well. I have tried different setups:

<ValidateInput(False), AcceptVerbs(HttpVerbs.Post)> _

...and...

<AcceptVerbs(HttpVerbs.Post), ValidateInput(False)> _

...and like this as well...

<ValidateInput(False)> _
<AcceptVerbs(HttpVerbs.Post)> _

Just to see if it made a difference, yet I still get the yellow screen of death. I only want to set it for this view and the specific action in my controller that my post pertains to. Am I missing something?

Answer

Jim Geurts picture Jim Geurts · Mar 27, 2010

With asp.net 4, you'll need to configure the validation mode in the web.config as well.

Set the following as a child of the <system.web> element:

<system.Web>
  ...
  <httpRuntime requestValidationMode="2.0"/>

Asp.Net 4 sets the requestValidationMode to 4.0 by default, which tells the system to perform request validation before the BeginRequst phase of the HTTP request. The validation will occur before the system reaches the action attribute telling it not to validate the request, thus rendering the attribute useless. Setting requestValidationMode="2.0" will revert to the asp.net 2.0 request validation behavior, allowing the ValidateInput attribute to work as expected.

Related questions

Download Excel file via AJAX MVC

I have a large(ish) form in MVC. I need to be able to generate an excel file containing data from a subset of that form. The tricky bit is that this shouldn't affect the rest of the form and …

Read More
How do I apply a CSS class to Html.ActionLink in ASP.NET MVC?

I'm building an ASP.NET MVC application, using VB.NET and I'm trying to apply a css class to a Html.ActionLink using the code: <%=Html.ActionLink("Home", "Index", "Home", new {@class = "tab" })%> But when I run the …

Read More
Add empty value to a DropDownList in ASP.net MVC

I'm building a data entry interface and have successfully bound the columns that have reference tables for their data using DropDownList so the user selects from the pre-configured values. My problem now is that I don't want the first value …

Read More