Submitting html code without setting ValidateRequest to false
I have a textbox and i want the user to be able to submit a youtube embed code. Is this po开发者_StackOverflow中文版ssible without setting 'ValidateRequest' to false?
No, you must turn it False to allow users to enter youtube embed code. you just have to encode your code to prevent cross site scripting.
Html encode the text and put it in a hidden input before submit, and then decode it on the server after submit.
精彩评论