A potentially dangerous Request.QueryString value was detected from the client when sending html markup from jquery post call to asp.net page

Question

I m making an ajax call using jQuery to an ASP.NET page which acts as my ajax server page to save the data which i am sending to it in the query string. In the ASP.NET page when i am trying to read the querystring i am getting this error:

A potentially dangerous Request.QueryString value was detected from the client...

I have set the ValidateRequest="false" in my page. Dont want to set it for all the pages. So did it in page level instead of config level:

  var content = "<h3>Sample header</h3><p>sample para</p>"
  content = encodeURIComponent(content);
  var url = "../Lib/ajaxhandler.aspx?mode=savecontent&page=home&ltxt=" + content;

     $.post(url, function (data) { 
       //check return value and do something
   });

and in my asp.net page:

 <%@ Page Language="C#" AutoEventWireup="true" CodeBehind="ajaxhandler.aspx.cs" ValidateRequest="false" Inherits="MyProject.Lib.ajaxhandler" %>

But when i am sending plain text instead of the html markup, it works fine.

Answer 1

If this is ASP.NET 4, there was a breaking change with ValidateRequest. See this StackOverflow question for more information on requestValidationMode.

Answer 2

There's already a good answer for this, and here i'll provide the information so that you don't have to click through links.

When running ASP.NET 4.0, you will need to set the following in your web.config file RequestValidationMode="2.0".

What is this property for?

A value that indicates which ASP.NET version-specific approach to validation will be used. The default is 4.0.

So what are the possible values?

• 4.0 (the default). The HttpRequest object internally sets a flag that indicates that request validation should be triggered whenever any
  HTTP request data is accessed. This guarantees that the request
  validation is triggered before data such as cookies and URLs are
  accessed during the request. The request validation settings of the
  pages element (if any) in the configuration file or of the @ Page
  directive in an individual page are ignored.

• 2.0. Request validation is enabled only for pages, not for all HTTP requests. In addition, the request validation settings of the pages element (if any) in the configuration file or of the @ Page directive in an individual page are used to determine which page requests to validate.

Information citated from this msdn site.