asp.net - .NET 4.0 上的 ASP.NET MVC2：[ValidateInput(false)] 是否足够？

Question

再会！

我计划将我的 ASP.NET MVC 2 应用程序升级到 .NET 4.0，并且有几个问题：

1. 有[ValidateInput(false)]足够的行动来接受 HTML，或者我需要<httpRuntime requestValidationMode="2.0"/>按照此处所述进行设置：ASP.NET 4 Breaking Changes

2. 如果我将 ASP.NET MVC 升级到版本 3（除了升级到 .NET 4.0），它将如何工作？

提前致谢！

Answer 1

1. You need to set <httpRuntime requestValidationMode="2.0"/> as well in ASP.NET 4.0.

2. The same as in ASP.NET MVC 2 (.NET 4.0) but in addition you have more fine grained control with the [AllowHtml] attribute which could be placed on a single property of your view model instead of disabling validation for the entire request:

   public class MyViewModel
   {
       [AllowHtml]
       public string SomeHtmlProperty { get; set; }
   
       public string SomeOtherProperty { get; set; }
   }
   

and have a controller action like this:

[HttpPost]
public ActionResult Update(MyViewModel model) { ... }