Aspdotnet-Suresh

aspdotnet-suresh offers C#.net articles and tutorials,csharp dot net,asp.net articles and tutorials,VB.NET Articles,Gridview articles,code examples of asp.net 2.0 /3.5,AJAX,SQL Server Articles,examples of .net technologies

A potentially dangerous Request.Form value was detected from the client in asp.net

Dec 4, 2011
Introduction:

In this post I will explain how to solve the problem “A potentially dangerous Request.Form value was detected from the client in ASP.NET WebForms” using asp.net.

Description: 

In previous post I explained clearly about Rich textbox sample in asp.net . After completion code if I try to insert some html formatted data in database using rich textbox I got error like “A potentially dangerous Request.Form value was detected from the client in ASP.NET WebForms

Sample data I used to insert in database

<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title>Untitled Page</title>
</head>
<body>
<form id="form1" runat="server">
<div>

</div>
</form>
</body>
</html>
After enter the above formatted html data in Rich Textbox and I tried to insert data then I got error message like


Server Error in ‘/RichTextboxSample’ Application.

A potentially dangerous Request.Form value was detected from the client (remarks =”<html></html>”)

Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. You can disable request validation by setting validateRequest=false in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case.

Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (remarks="<html></html>5678,<c…").

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.
This error occurs during insertion of html format data into database to eliminate this error we need to set ValidateRequest="false" in @Page line of web page or web.config file to solve security problems.

To solve this problem we need to add the ValidateRequest="false" in @Page line of web page like this

WebForms

<%@ Page Language="C#" AutoEventWireup="true"  CodeFile="Default.aspx.cs" Inherits="_Default" ValidateRequest="false" %>
In this way we need to set ValidateRequest="false" in required pages otherwise we can set it globally to work for all the pages without having this error we need to add ValidateRequest="false" in web.config file under system.web section like this

Web.Config

<system.web>
………………………
<httpRuntime requestValidationMode="2.0" />
<pages validateRequest="false">
</pages>
………………………
</system.web>
After set this property in webpage or web.config my problem has sovled and my code works perfectly. I hope it helps to solve your problem.

Happy Coding………

If you enjoyed this post, please support the blog below. It's FREE!

Get the latest Asp.net, C#.net, VB.NET, jQuery, Plugins & Code Snippets for FREE by subscribing to our Facebook, Twitter, RSS feed, or by email.

subscribe by rss Subscribe by RSS subscribe by email Subscribe by Email

27 comments :

shekar said...

Great.It Worked me Suresh, thank you very much

Akiii said...

it worked for me as well...thanks !

Anonymous said...

thx..

Anonymous said...

great.....thank you bhaii......

Anonymous said...

still getting error even after adding

Anonymous said...

hi
i am put this also but cant working

Atul said...

hello suresh,after puting validaterequest="False" i am still getting these error...pls do something...

A potentially dangerous Request.Form value was detected from the client (MainContent_FreeTextBox1="abc").

Atul said...

let it be...I correct it...by puting this also....your code was really helpful bro....thanx...

Atul Yadav said...

hhhh

Sudarshan Somayaji k. said...

really its working... Thank you sir... keep it up...

hermes said...

You help me solve the 'bad request' problem!

Anonymous said...

tu,

axe said...

i still cannot get rid of the potential dangerous error. sir, can u please help me out

Ambica_Shishu said...
This comment has been removed by the author.
Anonymous said...

Thanks! :) It worked for me.

I am storing the contents of RichBox in table with datatype nvarchar(MAX),still it is storing only partial data from rich tb..Any idea what to do

Anonymous said...

hi it's working for me thank u.

submit said...

I try it, but I can not find the bad Request.

Kavitha M said...

Dear Suresh,
I add validateRequest="false" in web config,design aspx page.But still the same error occured.Please Can you guide me

Anonymous said...

Dear suresh,
its not working for me.please provide another solution.

Shahabuddin shahab said...
This comment has been removed by the author.
Shahabuddin shahab said...

set
validationmode=2.0
then it will work

Anonymous said...

sir,
i am inserting html code in database and i want to retrieve plain text
so sir plz tell me how to convert html code into plain text


one more thing sir plz tell me the name of the control(facebook) which u use in your website in right side

Brijesh H. Vishwakarma said...

thx..

bharath said...

this is not working....i still get the same error.

Supdt. of Posts said...

if you add validateRequest="false" there is a possibility of XSS attack and website getting hacked.

chandra sekhar D said...

I have added the same but still i am getting the same error...

sakthideveloper said...

A potentially dangerous Request.Form value was detected from the client (FreeTextBox1="sdsadfsaf").
this error is coming after giving ValidateRequest="false" in iis. but it working in visual studio environment
Could you please help in this

Give your Valuable Comments

Other Related Posts

© 2010-2012 Aspdotnet-Suresh.com. All Rights Reserved.
The content is copyrighted to Suresh Dasari and may not be reproduced on other websites without permission from the owner.