ASP.net dangerous submission error

Question

When I try and run a forum page:

System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client 

In my web.config I have:

<pages validateRequest="false" smartNavigation="false">

And on the actual page I also have:

<%@ Page Language="C#" AutoEventWireup="true" ValidateRequest="false" MasterPageFile="~/MasterPages/Main.master" %>

But it keeps throwing this error!

Edit

I fixed it with:

<httpRuntime requestValidationMode="2.0" />

But what's that do and why does it work?

Answer 1

This error occurs because something in the submitted form, or in the querystring, looked dangerous to the validation in ASP.NET.

By adding

<httpRuntime requestValidationMode="2.0" />

you are relaxing the validation that is applied back to the standards of ASP.NET 2.

I would say you are far better off trying to work out exactly what it objects to in your form/querystring than just relaxing the validation. This tightened validation is there to protect you and your users, and shouldn't be relaxed lightly.

I have recently hit this on a project I am working on when we upgraded to ASP.NET MVC3 (from version 2). In our case it actually highlighted an issue whereby we were urlencoding our querystring when we didn't mean to (i.e. the entire quertstring including the question mark and the ampersands was all getting url encoded when it shouldn't be).

Whatever your reason, look for the root cause rather than relax the validation if it is at all possible.