0

I have a simple email form on my site with mvc c#.

If i added into the text box alert("test") I get the below exception:

A potentially dangerous Request.Form value was detected from the client (Message="<script>alert("test"...").

I dont want a user to be able to insert javascript. I need for html encode i would i do this on this field

 @Html.TextAreaFor(model => model.Message, new { @style = "width:800px;height:300px;" })
1

2 Answers 2

1

Option 1: look at the accepted answer at: HTML-encoding lost when attribute read from input field

Option 2: Put the [AllowHtml] attribute on the model item that binds to this textbox and that will let the value into your controller where you can use HtmlEncode.

Option 3: Put the [ValidateInput(false)] attribute on your controller action, this lets everything through no matter what and then you can do your own custom validation for everything

0

Use System.Web.HttpUtility.HtmlEncode to encode all user input and avoid XSS atacks.

1
  • how do i add this to the control though @Html.TextAreaFor Nov 8, 2013 at 12:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.