Hi people. I passed a value to Session["email"], and at the button1_click function, i have a sql statement with allows users to delete a record from [Comment] when the Session["email"] equals the email inside the [Comment] table..
But it occurs the below error :
Invalid postback or callback argument. Event validation is enabled using <pages enableEventValidation="true"/> in configuration or <%@ Page EnableEventValidation="true" %> in a page. For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them. If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation.

What is the problem over here?

protectedvoid Page_Load(object sender, EventArgs e)
{
Emaillbl.Text = Session["email"].ToString();
Emaillbl.Visible = false;
string updateID = Request["UpdateID"];
string strConString = ConfigurationManager.ConnectionStrings["SocialSystemConnectionString"].ConnectionString;
SqlConnection con = newSqlConnection(strConString);
SqlCommand cmd = newSqlCommand("SELECT Comment.CommentID, Comment.TextInput, Comment.SystemDate, [User].UId, [Update].UpdateID, [Update].Email FROM Comment INNER JOIN [Update] ON Comment.UpdateID = [Update].UpdateID INNER JOIN [User] ON [User].Email = [Comment].Email WHERE [Comment].UpdateID = @UpdateID ORDER BY SystemDate", con);
cmd.Parameters.Add("@UpdateID", SqlDbType.VarChar).Value = updateID;
con.Open();
SqlDataReader reader = cmd.ExecuteReader();
GridView1.DataSource = reader;
GridView1.DataBind();
reader.Close();
con.Close();

}

protectedvoid Button1_Click(object sender, EventArgs e)
{
string strConString = ConfigurationManager.ConnectionStrings["SocialSystemConnectionString"].ConnectionString;
SqlConnection conn = newSqlConnection(strConString);
SqlCommand cmd = newSqlCommand("DELETE FROM [Comment] WHERE [Comment].Email = 'Emaillbl.Text' ", conn);
conn.Open();
conn.Close();
}

What LINE in that code does the error refer to???

And you didn't ask, but SURELY this code is wrong:

That would delete all records where the value of the EMAIL field is REALLY AND TRULY the *STRING*

Code:

      Emaillbl.Text

No, not the value that is in the <FORM> field Emaillbl. Really and truly THAT EXACT STRING.

I think/assume you meant to use:

Code:

Except that does leave you vulnerable to SQL injection attacks.

hi.guy.
there is no wrong in your sql code,
you just only add ValidateRequest="false" in your aspx
.
<%@ page ValidateRequest="false"%>