ValidateRequest

[d k via .NET 247]

How do you handle the HttpRequestValidationException?

I don't want an error page to appear, a repost and an error message. Is there another alternative to handle this if ValidateRequest id set to false?

 

[Peter Blum]

I have two suggestions:
1. The Page has an event called Error where you will catch every unhandled
exception. Use it to confirm this exception exists and set a flag on your
page.
Add a customValidator to the page with the right error message. Its
ServerValidation function will test that flag on the page. If it indicates
and error, the method indicates its invalid.

2. I build a system that replaces ValidateRequest with actual validators
that can handle individual fields. This way, you can define the exact HTML
tags permitted on a field-by-field basis. It still handles security on
cookies, query strings, and hidden fields. Its called VAM: Visual Input
Security (http://www.peterblum.com/vise/home.aspx)

--- Peter Blum
www.PeterBlum.com
Email: (e-mail address removed)
Creator of "Professional Validation And More" at
http://www.peterblum.com/vam/home.aspx

 

[Guest]

I found a solution at the following site which handled for the error:

http://www.asp.net/Forums/ShowPost.aspx?tabindex=1&PostID=811547

The code is generic--you aren't letting the user know which field is
specifically causing the problem--but it works. I made the following
modifications to the code:

protected override void OnError(System.EventArgs e)
{
if(Server.GetLastError().GetBaseException() is
System.Web.HttpRequestValidationException)
{

// Write the error to the trace log.
Trace.Warn("Error","Error event",Server.GetLastError());
// Save a message to display as a Session state variable.
Session["Error"]="<p>One or more of the values entered into
the form are invalid. Try your task again.</>";
// Clear the error.
Server.ClearError();
Response.Redirect("AddContact.aspx");
}
}