ValidateRequest

[Luca Giuffrida]

Could it be dangerous to disable validation of HTML tag in my WebForm?

Thanks in advance,
Luca

 

[Karl Seguin]

Yes, people can inject code into your website, but only if you aren't
careful.

say you let users input any value, and simply dump it out to the browser,
they could input something like:

Welcome to my section <script language='javascript'>alert(all your bases are
belong to us!!')</script>

and when you display the content, it will actually output that and make it
look like your site is doing it. Better hax0rs could do more damage then my
little script

I don't like the validation, but don't trust user input. If you simply
HTMLEncode any raw value you output, I think you'll be ok.

Karl

 

[Luca]

Does exist a valid solution for this problem

Thanks agai

Luc

 

[Bruce Barker]

yes, if you don't code well. MS added validation to prevent common injection
attacks, which like buffer overrun attacks, count on coding errors. If you
don't understand the issues, and have test for it, turning it off is
dangerous.

-- bruce (sqlwork.com)