开发者

asp.net ValidateRequest=false per textbox instead of per page?

开发者 https://www.devze.com 2023-01-13 06:35 出处:网络
Is there a way to disable request validation for just certain textboxes instead of the whole page?I\'m using Server.HtmlEncode/Decode because users are legitimately using < and > characters but I d

Is there a way to disable request validation for just certain textboxes instead of the whole page? I'm using Server.HtmlEncode/Decode because users are legitimately using < and > characters but I don't want to use ValidateRequest="false" on the whole page because someone could add a textbox later and forget to escape the input in which case I would want validation to occur so the error would be discovered rather than be vulnerable to html injection.

It seems like开发者_Go百科 there has to be a simple solution but I'm not having any luck finding it.

(Webforms not MVC)


No, request validation is for the entire request and cannot be done on an element by element basis. Request validation is enabled by ASP.NET by default and is to help those out that do not know about sanitizing HTML inputs from script injection attacks. Posted some links below for further reading:

MSDN

Stackoverflow


According to this answer, you can do it in .NET 4.5:

http://msdn.microsoft.com/en-us/library/system.web.ui.control.validaterequestmode.aspx

0

精彩评论

暂无评论...
验证码 换一张
取 消