开发者

How to By Pass Request Validation

I have a GridView and I need update some data inserting HTML CODE; I would need this data been stored encoded and decoded on request.

I cannot in any way disable globally "Request Validation" and not even开发者_运维百科 at Page Level, so I would need a solution to disable "Request Validation" at Control Level.

At the moment I am using a script which should Html.Encode every value being update, butt seems that "Request Validation" start its job before event RowUpdating, so I get the Error "Page A potentially dangerous Request.Form ... ".

Any idea how to solve it?

Thanks

protected void GridView1_RowUpdating(object sender, GridViewUpdateEventArgs e)
    {
        foreach (DictionaryEntry entry in e.NewValues)
        {

            e.NewValues[entry.Key] = Server.HtmlEncode(entry.Value.ToString());

        }

PS I USE Wweb Controls not MVC


Use method RegisterOnSubmitStatement to register script that will encode values of all input-fields before submiting and decode values of those fields at server side.

string script = String.Format("var inputs = $get('{0}').getElementsByTagName('input');" + 
  "for(var i = 0; i < inputs.length; i++) " + 
    "inputs[i].value = encodeURIComponent(inputs[i].value);", this.ClientID);
Page.ClientScript.RegisterOnSubmitStatement(this.GetType(), "onsubmit", script);


For simple textbox or hidden field controls, if the ID of the control begins with __ (two underscores) then the request validation is skipped for those controls. I used this to have my whole page and site proctected, yet bypass it for one control. However this is not an offical way so it may be changed in future .net releases.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜