How to store HTML tags in SQL 2008 Simple (taking HTML code as input in textbox and stored it in database)

Question

Error:

A potentially dangerous Request.Form value was detected from the client (ctl00$ContentPlaceHolder1$htmlCode="table style="backgr...")

Code:

    SqlConnection n_con = new SqlConnection(constring);
    n_con.Open();
    string N_Query = "update imageAd set code = '"+textbox1.text+"' where id = '" + id + "'";
    SqlCommand N_cmd = new SqlCommand(N_Query, n_con);
    N_cmd.ExecuteNonQuery();

Learn about parameterised queries, particularly if turning off request validation as mentioned by @jafarbtech — Jon P
– Jon P, Commented Nov 21, 2016 at 5:08

jafarbtech · Accepted Answer · 2016-11-21 04:48:58Z

2

Set validateRequest="false" in the <%@ Page ... %> directive in your .aspx

In .NET 4 you may need to do a little more. Sometimes it's necessary to also add <httpRuntime requestValidationMode="2.0" /> to web.config

Note : But this will cause script injection and Sql injection attacks possible in that page. Thats why it shows "A potentially dangerous". To prevent it use Lbel1.Text = Server.HtmlEncode(TextBox1.Text) when you displaying the html which u got input from this page. you can negotiate it if you are using in admin side of the webpage

edited Nov 21, 2016 at 4:48

answered Nov 19, 2016 at 21:16

jafarbtech

7,0551 gold badge41 silver badges60 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

halfer Over a year ago

Erm, doesn't this query have an enormous SQL injection vulnerability in it, and isn't that worth mentioning in your answer?

Collectives™ on Stack Overflow

How to store HTML tags in SQL 2008 Simple (taking HTML code as input in textbox and stored it in database)

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related