Search code examples
htmlajaxcontroltoolkit

Getting error when posting a form with html tags in its fields

I am using Ajax Control Toolkit 3.5. I have a form like this:

<body>
<form id="form1" runat="server">
<asp:ToolkitScriptManager ID="ToolkitScriptManager1" runat="server">
</asp:ToolkitScriptManager>
<div>
    <asp:UpdatePanel ID="UpdatePanel1" runat="server">
        <ContentTemplate>
            <asp:TextBox ID="TextBox1" runat="server"></asp:TextBox>
            <asp:Button ID="Button1" runat="server" onclick="Button1_Click" Text="Button" />
            <asp:Label ID="Label1" runat="server" Text="Label"></asp:Label>
        </ContentTemplate>
    </asp:UpdatePanel>
</div>
</form>

And related codebehind of this page is this:

protected void Button1_Click(object sender, EventArgs e)
{
    Label1.Text = TextBox1.Text;
}

When I write for example "foo" into the TextBox1 it succesfully copies that into Label1. But if I write any text into the textbox with some HTML tags like "<b>foo</b>" i get following Javascript error in IE statusbar:

alt text

How can I solve this?

Thanks in advance.

Solution

  • Just after posting this question, the idea of taking the form fields out of UpdatePanel and retrying the same operation came to my mind. Bingo! It throws the following exception:

        A potentially dangerous Request.Form value was detected from the client (TextBox1="<b>foo</b>"). 
Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. You can disable request validation by setting validateRequest=false in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case. 

Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (TextBox1="<b>foo</b>").

    After seeing this error, adding the following code to the <%@ Page %> section of the page solved the problem.

    ValidateRequest="false"

    Hope this helps to others...