I'm having some trouble using TinyMCE with ASP.NET Web Pages Razor 2. I'm trying to use TinyMCE with updating articles with SQL, however, it gives me this error:
"There was found a potentially dangerous Request.Form value for the client (Content="<p>Lorem ipsum dolor...")."
Linje 22: var update = "UPDATE [Tutorials] SET Heading=@0, Content=@1, Type=@2 WHERE ID=@3";
Linje 23: Heading = Request["Heading"];
Linje 24: Content = Request["Content"];
Linje 25: Type = Request["Type"];
Linje 26: db.Execute(update, Heading, Content, Type, TutorialId);
@{
Validation.RequireField("Heading", "Heading is required.");
Validation.RequireField("Content", "Content is required.");
Validation.RequireField("Type", "Type is required.");
var Heading = "";
var Content = "";
var Type = "";
var TutorialId = UrlData[0];
if (TutorialId.IsEmpty()) {
Response.Redirect("~/Members/Tutorials/List");
}
var db = Database.Open("MikZeRCoding2");
string htmlEncoded = WebUtility.HtmlEncode(Content);
if (IsPost && Validation.IsValid()) {
var update = "UPDATE [Tutorials] SET Heading=@0, Content=@1, Type=@2 WHERE ID=@3";
Heading = Request["Heading"];
Content = Request["Content"];
Type = Request["Type"];
db.Execute(update, Heading, Content, Type, TutorialId);
Response.Redirect("~/Members/Tutorials/List");
}
else {
var select = "SELECT * FROM [Tutorials] WHERE ID=@0";
var row = db.QuerySingle(select, TutorialId);
Heading = row.Heading;
Content = row.Content;
Type = row.Type;
}
}
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8" />
<title>Edit Tutorial - Admin Area</title>
</head>
<body>
<script type="text/javascript">
tinymce.init({selector:'textarea'});
</script>
<form method="post" action="">
<div class="content-container">
<ul>
<li>
<h3>Title</h3>
<input type="text" name="Heading" value="@Heading" />
</li>
<li>
<h3>Content</h3>
<textarea name="Content" id="content-editor">@Content</textarea>
</li>
<li>
<h3>Type</h3>
<input type="text" name="Type" value="@Type" />
</li>
<li>
<input type="submit" value="Update" />
@Html.ValidationSummary()
</li>
</ul>
</div>
</form>
</body>
</html>
You need to use Request.Unvalidated
if you want to permit HTML to be posted:
Content = Request.Unvalidated("Content");
See more about request validation in ASP.NET Web Pages here: http://www.mikesdotnetting.com/Article/222/Request-Validation-In-ASP.NET-Web-Pages