Control level ValidateRequestMode has no effect

c# asp.net .net webforms request-validation
EvilBeer picture EvilBeer · May 13, 2014 · Viewed 10.1k times · Source

I'm using ASP.NET WebForms (.NET 4.5) and have an "content block" control, which is reused on a number of pages. I've tried setting the ValidateRequestMode of the control and even individual elements to "Disabled", but the request validation coming from web.config still prevents unsafe input.

Is there a way around this or am I doing something wrong?

Example:

Answer

Jason Elkin picture Jason Elkin · Feb 5, 2015

I just solved this same problem for a site with the code below, after a morning of trial and error - Microsoft's documentation on the new Request Validation process seems to be wrong when it comes to WebForms.

Target .NET 4.5 in the web.config like this:

<httpRuntime targetFramework="4.5" requestValidationMode="4.5" />

And then adding ValidateRequestMode="Disabled"to the input controls themselves i.e.:

<asp:textbox id="myControl" runat="server" ValidateRequestMode="Disabled"/>

If you are accessing POST data directly (as opposed to via myControl.Text) You will also need to bypass validation at that point:

Request.Unvalidated.Form("myControl");

Related questions

In C#, what is the difference between public, private, protected, and having no access modifier?

All my college years I have been using public, and would like to know the difference between public, private, and protected? Also what does static do as opposed to having nothing?

Read More
How to Convert JSON object to Custom C# object?

Is there an easy way to populate my C# Object with the JSON object passed via AJAX? This is the JSON Object passed to C# WEBMETHOD from the page using JSON.stringify { "user": { "name": "asdf", "teamname": "b", "email": "c", "players": ["1", "2"] } } …

Read More
How to set session timeout in web.config

I have tried very hard but cannot find a solution on how to set session timeout value for in-process session for an ASP.Net web application. I am using VSTS 2008 + .Net 3.5 + C#. Here is what I wrote by myself to …

Read More