Allow HTML in text boxes

Question

I'm using ASP.NET MVC.

How can I allow users to enter HTML into a textbox? I'm seting validaterequest to false and still getting this error:

A potentially dangerous Request.Form value was detected from the client (Summary="<a>").

I know its not recommended etc, but it's for internal use.

Answer 1

If you are using DataAnnotations on your model, you can open up a single property to allow HTML by using the AllowHtml attribute. Note that this attribute is in the System.Web.Mvc namespace.

This would probably be recommended over setting ValidateInput to false at the action level.

Answer 2

Add the ValidateInput(false) attribute to your action

[ValidateInput(false)]
public ActionResult MyAction (int id, string content) {
}