Inserting HTML code to Database SQL using WebMatrix Razor

Question

My Column in the DB are: nvarchar(MAX)

I need to add HTML code into my Database: from CKEditor. I get the following Error.

A potentially dangerous Request.Form value was detected from the client (Description="<h1>Heding 1&nbsp;</...").

I am using the following Code:

var String=Request["String"];

I even used the following:

 var String= HttpUtility.HtmlEncode(Request["String"]);
String=Request["String"];

here is part of my code:

 if(IsPost){
    var Description =Request.Unvalidated["Description"];
    // Here I insert into Database

and The FORM part is:

<form action="" enctype="multipart/form-data" method="post">
<div class="row">
    <div class="two columns offset-by-two"><br/><label> Description: </label><br/></div>
    <div class="eight columns"><textarea name="Description"></textarea></div>

I want to store the text from "Description" to my database....

Mike Brind · Accepted Answer · 2013-01-02 19:35:11Z

2

You simply need to use Request.Unvalidated to reference inputs that contain HTML if you don't want ASP.NET Request validation kicking in within the ASP.NET Web Pages framework:

var text = Request.Unvalidated["myTextBox"];

Or:

var text = Request.Unvalidated("myTextBox");

edited Jan 2, 2013 at 19:35

answered Dec 31, 2012 at 20:32

Mike Brind

30.3k6 gold badges65 silver badges95 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Dawood Awan Over a year ago

Will this leave it Vulnerable to SQL injection?

Mike Brind Over a year ago

No, this has nothing to do with SQL injection which is protected against by using parameterised queries. And what does "didn't work" mean? Are you sure you referenced the correct input? Can you provide a small repro of your page?

Mike Brind Over a year ago

I just tested with your code (adding a submit button and closing the form) and it works fine for me.

Dawood Awan Over a year ago

Did you add the CKEditor javascript to your file?

Dawood Awan Over a year ago

Which Library contains: Request.Unvalidated[]

|

Yusubov · Accepted Answer · 2012-12-31 18:34:26Z

0

It looks like HtmlEncoding should do the trick.

Did you try the following:

var myColumnData = HttpUtility.HtmlEncode(Request["String"]);

Then pass this myColumnData, and all other columns to your Database table.

Edit: In addition to above, you may also want to look at the project settings, as it is recommended in the following blog - A potentially dangerous Request value was detected from the client.

answered Dec 31, 2012 at 18:34

Yusubov

5,8439 gold badges35 silver badges69 bronze badges

1 Comment

Mike Brind Over a year ago

HtmlEncoding won't do the trick at all. You will get the same error.

flakomalo · Accepted Answer · 2013-04-26 12:50:23Z

0

This did the trick for me.

var text = Request.Unvalidated["myTextBox"];

Thank you.

answered Apr 26, 2013 at 12:50

flakomalo

7105 silver badges4 bronze badges

Comments

Ifeanyi Chukwu · Accepted Answer · 2013-05-30 07:05:14Z

0

SAFETY RULES.....Before you push it to the database, i suggest you filter suspicious tags such as script tags.

var x = Request.Unvalidated("MyField");

if(x.Contains("<script>") || x.Contains("</script>")){
    //no script tag allowed.
}

answered May 30, 2013 at 7:05

Ifeanyi Chukwu

3,3473 gold badges32 silver badges33 bronze badges

Collectives™ on Stack Overflow

Inserting HTML code to Database SQL using WebMatrix Razor

4 Answers 4

6 Comments

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

6 Comments

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related