Request Validation - ASP.NET MVC 2

Question

Has request validation changed for ASP.NET MVC 2, more precisely, not validating?

I did the following:

Web.configs (in App directory and Views directory)

<pages
    validateRequest="false"

Controller/Action Attribute

[ValidateInput(false)]

In @Page View Directive

ValidateRequest="false"

The page still gets validated an exception is thrown when HTML content is posted.

UPDATE

Created a new ASP.NET MVC 2 Application and I modified the Home Controller's Index to this

    [ValidateInput(false)]
    public ActionResult Index(string InputText)
    {
        ViewData["Message"] = "Welcome to ASP.NET MVC!";

        return View();
    }

and my View Page

<% using(Html.BeginForm()){ %>
    <%= Html.TextBox("InputText") %>
    <input type="submit" />
<% } %>

And still the same issue, an exception is thrown.

Andrew · Accepted Answer · 2012-03-08 10:30:29Z

31

I should read the error more carefully next time:

To allow pages to override application request validation settings, set requestValidationMode="2.0" in the configuration section. After setting this value, you can then disable request validation by setting validateRequest="false"

I put this in the application's web.config

<system.web>
  <httpRuntime requestValidationMode="2.0" requestPathInvalidCharacters="" />
</system.web>

and it worked.

Update:

I was running ASP.NET 4 thats why :P

edited Mar 8, 2012 at 10:30

Andrew

13.3k15 gold badges58 silver badges87 bronze badges

answered Oct 30, 2009 at 11:07

Omar

40.3k46 gold badges150 silver badges215 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Omar Over a year ago

Inside the <system.web> begin/end tags

Alexandre Brisebois Over a year ago

this did not work for me, I had to use the attributes for MVC2 RTM

Omar Over a year ago

@Alexandre Brisebois, odd are you using .NET 4?

Alexandre Brisebois Over a year ago

yes, but thinking of it, it's on a project that was upgraded by VS 2010

Omar Over a year ago

I misunderstood your first comment. You have to use attributes AND this setting in your Web.config file for it to work in .NET 4

|

Dan Atkinson · Accepted Answer · 2009-10-30 09:03:34Z

2

^{Insert obligatory warning about XSS here.}

That you decorated the controller (or action) with the ValidateInputAttribute should be enough, as all validation is done at this controller level in ASP.NET MVC

I have just tried this now on an action, and it returns a nice, evil alert() when I output it, so I'd venture a guess that there's something else going on here.

Do you have an HandleErrorAttribute set up anywhere?

answered Oct 30, 2009 at 9:03

Dan Atkinson

11.8k14 gold badges89 silver badges116 bronze badges

2 Comments

Omar Over a year ago

I implemented a custom viewpage you can see at stackoverflow.com/questions/1480373/… , looking to see if anything is causing it to validate with ASP.NET MVC 2

Omar Over a year ago

No HandleError attribute too.

Collectives™ on Stack Overflow

Request Validation - ASP.NET MVC 2

2 Answers 2

6 Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

6 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related