ValidateRequestMode=Enabled

Antonius Block · December 24th, 2013, 03:22 PM

On page 333 (chapter 9 - Validate user input), I read:

"When set to Enabled, the control does not accept HTML; when set to Disabled the control does accept HTML".

Unfortunately, in both cases I get the same unhandled exception (in figure 9-10, on page 333).

How can I handle this exception nicely and protect my controls from Cross site Scripting Attacks ?

Thank you
Roberto

Imar · December 25th, 2013, 09:06 AM

Hi Antonius,

How does your web.config look? It works for me with the following code:

Code:

<system.web>
  ...
  <httpRuntime requestValidationMode="4.5"/>
  ...
</system.web>

Cheers,

Imar