18

FYI I am using .NET 4.0 / MVC 3.

In my controller, the following is my code:

[HttpPost]
[ValidateInput(false)]
public ViewResult Edit(ContentTemplateView contentTemplateView, FormCollection collection)

Everything works fine when I don't enter HTML, so I know the proper controller is being fired. Also, I have following set properly in my web.config files:

<httpRuntime requestValidationMode="2.0"/>

I only get this problem when I include the FormCollection (which is needed for this particular Controller). So what exactly am I doing wrong?

[I have done what was proposed on the following questions, and they work as long as there is no FormCollection. None of them offer a solution with an included FormCollection]

3 Answers 3

22

I think I've solved my own riddle, with the help of this forum: http://forums.asp.net/p/1621677/4163625.aspx

I just modified my Controller so that it didn't accept the Controller, and instead grabbed the unvalidated form collection from the Request [with the help of System.Web.Helpers].

using System.Web.Helpers;

[HttpPost]
[ValidateInput(false)]
public ViewResult Edit(ContentTemplateView contentTemplateView)
{
    FormCollection collection = new FormCollection(Request.Unvalidated.Form);
5
  • 1
    BTW I believe this bug is fixed for the next release of ASP.NET MVC 3, so this workaround won't be needed when you upgrade to that release.
    – Eilon
    Dec 6, 2010 at 2:29
  • I have tried to add a reference to the System.Web.Helpers dll, and added a using System.Web.Helpers in my controller, but it wont accept Unvalidated() as a method under Request. Im using .NET 4 and MVC 3 RC. Dec 8, 2010 at 20:35
  • @Martin just answered your question: stackoverflow.com/questions/4392186/…
    – marcind
    Dec 8, 2010 at 21:06
  • This help help to resolve my problem! I have this problem "Preventing CSRF With Ajax" (haacked.com/archive/2011/10/10/preventing-csrf-with-ajax.aspx) but this is fired before ValidateInput(false) so I replace _form = new NameValueCollection(request.Form); with _form = new NameValueCollection(request.Unvalidated().Form);
    – Vackup
    Feb 29, 2012 at 14:13
  • Yes, it works. You should also add the following to web.config <httpRuntime requestValidationMode="2.0" /> May 8, 2013 at 2:00
7

I just installed ASP.NET MVC 3 RC2, and this bug has been fixed. The following code works as expected now.

[HttpPost]
[ValidateInput(false)]
public ViewResult Edit(FormCollection form)
{
}
0

If you are using custom model binders and [ValidateInput(false)] is not working then you might find a solution here: http://blogs.taiga.nl/martijn/2011/09/29/custom-model-binders-and-request-validation/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.