Writing HTML text in Asp.Net

The .NET framework throws error when we try to enter text which looks like an HTML statement . The text doesn't need to contain valid HTML, just anything with opening and closing angled brackets ("<...>").

The reason behind the error is as a security precaution. Developers need to be aware that users might try to inject HTML (or even a script) into a text box which may affect how the form is rendered

This checking was not performed in the .NET 1.0 framework and was introduced with the .NET 1.1 framework.

Remedy:

The remedy is in two parts and you MUST action both:

1. To disable request validation on a page add the following directive to the existing "page" directive in the file - you will need to switch to the HTML view for this:

<%@ Page Language="vb" AutoEventWireup="false" Codebehind="MyForm.aspx.vb" Inherits="Proj.MyForm" ValidateRequest="false"%>

Alternately, you can globally turn request validation off (but in which case be sure to implement item two below). To globally turn request validation off add the following to your web.config file:

this should go within the section. This will turn off request validation for every page in your application.

Warning

With request validation turned off, users will be able to enter html into text boxes on the page. For example entering:

will be rendered by the browser (when the form is updated and the contents redisplayed) as JavaScript and a message box will appear with the message "Hi Amit". This is generally considered to be undesirable!

Unless you actually need users to be able to enter HTML you must convert the string to its html encoding equivalent - basically this means that certain characters (like "<") are converted to codes (so "<" is converted to "<"). To perform this conversion use HttpUtility.HtmlEncode, for example:

MyTextBox.Text = HttpUtility.HtmlEncode(MyTextBox.Text);

You only need to consider this for any text that will be rendered in the browser.