asp.net - ValidateRequest="false" 和 .NET 4 问题

Answer 1

I can confirm that the approach of adding validateRequest="true" to the web.config file works and it is marvellous!

Using this makes the page-level directives work correctly again and it avoids the need to change the behaviour back to the ASP.Net2.0 mode.

Strange that it has any effect, seeing as request validation is normally enabled by default anyway, but no matter.

Answer 2

if you are using .net4 then add this line to web config

<pages validateRequest="false">

and no need to use <httpRuntime requestValidationMode="2.0" /> at all

Answer 3

OK, looks like this can't be done and I can just escape the data easily, but I think this was a legitimate question -- at least to make a note here that this can't be done.

Answer 4

I found a better way, I think. I didn't like the option of reverting back to a 2.0 setting while in 4.0. I also don't like the all or none option.

I played around with a few things and I have at least in my mind a practical solution. By default all pages are validated regardless of the page directive of "ValidateRequest="false"

I found where to make this setting in the web.config in the system.web section called pages. (http://msdn.microsoft.com/en-us/library/system.web.configuration.pagessection.validaterequest.aspx)

If the validateRequest attribute is added into the pages element you can control the validation for the whole site.

But I stumbled across a happy thing while testing this. I couldn't find docuementation for this, but here is what I've experienced. By default validation is turned on everywhere, but if I set the validateRequest to "true" my individual page directives work as they did in 2.0. I don't know why, but I'm happy.

So in summary... Set the validateRequest to true. Like here.

Then any page directives work for that validation.

Answer 5

I just put this in my web.config in the system.web node.

<httpRuntime requestValidationMode="2.0" />