A potentially dangerous Request.Form value was detected from the client Error in .NET

While working on an Asp.net web projects, We sometimes got an issue like A potentially dangerous Request from the client.
.
.
What does this error means? Simply it means when user enters non-encoded HTML content into a textbox or passing via querystring.

Here in this tutorial, I’ll explain how to resolve error like “A potentially dangerous Request.Form value was detected from the client” with cause and solution.

Error: A potentially dangerous Request

The above exception occurs when ValidateRequest is set true (by default it sets to true) and someone tries to submit HTML content to server (for example, <span>Hi, How are you?</span>). When we parse this HTML content, this error comes since Asp.net tries to protect the application from Scripting Attacks. Most likely, it’ll comes when you’re working with Rich TextBoxes or Rich Text Editors to parse HTML content to server.

Error Cause:

The .NET framework is throwing up an error because it detected something in the entered text which looks like an HTML statement. The text doesn’t need to contain valid HTML, just anything with opening and closing angled brackets “<…>”.

The reason behind the error is as a security precaution. Developers need to be aware that users might try to inject HTML (or even a script) into a text box which may affect how the form is rendered. You can get more details at Request Validation – Preventing Script Attacks here.

Note: This checking was not performed in the .NET 1.0 framework and was introduced with the .NET 1.1 framework.

Error Solution:

To disable request validation to a specific page, we need to add the ValidateRequest=”false” to the existing Page directive in that .aspx file:

Note: If you are using Asp.net 4.0+, you must needs to add or update the <httpRuntime requestValidationMode=”2.0″/> to the web.config file:

Note: If you want to turn off validation request globally for every page, you need to add the <pages validateRequest=”false” /> line with above validation mode statement in the existing web.config file: