vendredi 26 août 2011

How to allow user to input html in ASP.NET MVC

“Whenever we submit HTML or JavaScript as input in ASP.NET MVC application we get an exception like "A potentially dangerous Request.Form value was detected from the client (……)”. Because ASP.NET MVC has built-in request validation that helps you automatically protect against cross-site scripting (XSS) attacks and HTML injection attacks, it will prevent the user from posting HTML or JavaScript as input”…

http://dailydotnettips.com/2011/08/24/how-to-allow-user-to-input-html-in-asp-net-mvc/

[ValidateInput(false)] attribute disables request validation on complete model or view model

...

We can [AllowHtml] attribute on properties in model or view model to disable request validation.

Aucun commentaire:

Publier un commentaire