Using requestValidationMode="2.0" in ASP.NET MVC 3 (.NET 4.0)

I need to disable the request validation for single controller method. (A service is posting xml to me and I have no control over the encoding etc.)

So setting [ValidateInput(false)] on the Method and having requestValidationMode="2.0" on the httpruntime tag in the web.config works.

But开发者_如何学Python what I don't like is reverting to a less secure model, just to get on single method working.

Is my assumption correct, that it is less secure? Or is there a way of recieving this post withouth disabling the .Net validation model?

Honestly, I don't really know the difference between the different validation modes.

However you can put a ValidateInput(false) and use Request.Unvalidated() to capture a specific property.