html markup allowed in textbox even though validaterequest=true

[Andy Fish]

Hi,

I have a web form with 2 text boxes on it. I have not set
validateRequest=false in the @page directive so request validation should be
on.

One of the text boxes correctly gives the "A potentially dangerous
Request.Form value..." Exception when trying to enter HTML markup. However,
the other one allows it through.

The form is rather large and complex so I can't just post the whole thing
here, but does anyone know how one textbox would be able to skip the form
validation feature?

TIA

Andy

 

[Andy Fish]

OK, I figured out what was happening. I wasn't comparing like with like.

What actually happens is that the page validation does not throw out all
html markup. it allows end tags but not start tags. So it's possible to put
in something like "</td></tr></table>" into a textbox which will screw up
the display but I guess this wouldn't normally be 'dangerous'