A potentially dangerous Request.QueryString value was detected from the client when sending html markup from jquery post call to asp.net page

user_40521 0
Viewed 88502

I m making an ajax call using jQuery to an ASP.NET page which acts as my ajax server page to save the data which i am sending to it in the query string. In the ASP.NET page when i am trying to read the querystring i am getting this error:

A potentially dangerous Request.QueryString value was detected from the client...

I have set the ValidateRequest="false" in my page. Dont want to set it for all the pages. So did it in page level instead of config level:

  var content = "<h3>Sample header</h3><p>sample para</p>"
  content = encodeURIComponent(content);
  var url = "../Lib/ajaxhandler.aspx?mode=savecontent&page=home&ltxt=" + content;

     $.post(url, function (data) { 
       //check return value and do something
   });

and in my asp.net page:

 <%@ Page Language="C#" AutoEventWireup="true" CodeBehind="ajaxhandler.aspx.cs" ValidateRequest="false" Inherits="MyProject.Lib.ajaxhandler" %>

But when i am sending plain text instead of the html markup, it works fine.

asp.net-ajax security asp.net jquery ajax
6 Answers

In my case, instead of [HttpPost] having [HttpPost, ValidateInput(false)] solved the issue. Controller Action code example below:

[HttpPost, ValidateInput(false)]
[AcceptVerbs(HttpVerbs.Post)]
[ValidateAntiForgeryToken]
public ActionResult UploadFile(HttpPostedFileBase blob)
{
     //your action code here
}
user_122029640
Related