Error - A potentially dangerous Request.Form value was detected

Hi Naimish

  It remains on Modal Popup but error message is not getting displayed.

hfErrorMessage.Value = System.Web.HttpUtility.HtmlEncode(errMessage);
                    ScriptManager.RegisterStartupScript(this, this.GetType(), "ShowModal", "$('#modal_form_horizontal').modal('show');", true);

Thanks

The error you’re encountering, System.Web.HttpRequestValidationException, occurs because ASP.NET is detecting potentially dangerous content (like HTML or script) in the request. This is a security feature to prevent cross-site scripting (XSS) attacks.

To resolve this issue, you can either:

1. Encode the error message to prevent HTML content from being interpreted as dangerous.
2. Disable request validation for the specific control or page (less recommended due to security risks).

Option 1: Encode the Error Message

You can encode the error message before assigning it to hfErrorMessage to ensure that any HTML tags are treated as plain text. Here’s how you can do it:

using System.Web;

protected void btnSubmit_Click(object sender, EventArgs e)
{
    string errMessage = "";

    if (String.IsNullOrWhiteSpace(txtBankName.Text))
    {
        errMessage += "Bank Name is required and cannot be empty.
";
    }

    if (errMessage == "")
    {
        try
        {
            if (hdfId.Value == "0")
            {
                using (SqlConnection con = new SqlConnection(Common.CommonFunction.cnn_Live))
                {
                    SqlCommand cmd = new SqlCommand("Sp_Bank", con);
                    cmd.CommandType = CommandType.StoredProcedure;

                    cmd.Parameters.AddWithValue("@Action", "I");
                    cmd.Parameters.AddWithValue("@BankCode", SqlDbType.VarChar).Value = txtBankCode.Text.ToUpper();
                    cmd.Parameters.AddWithValue("@BankName", SqlDbType.VarChar).Value = txtBankName.Text.ToUpper();
                    SqlParameter successParam = cmd.Parameters.Add("@Success", SqlDbType.Bit);
                    successParam.Direction = ParameterDirection.Output;
                    con.Open();

                    cmd.ExecuteNonQuery();
                    bool success = (bool)successParam.Value;
                    if (success)
                    {
                        string message = Common.CommonFunction.recordInsertedSucessfully;
                        ShowMessage("Success", message, "Success");
                    }
                    else
                    {
                        ShowMessage("Oops...", success.ToString(), "error");
                    }
                }
            }

        }
        catch (Exception ex)
        {
            ShowMessage("Oops...", Common.CommonFunction.ErrorMessage, "error");
        }
    }
    else
    {
        if (errMessage == "")
        {
            ShowMessage("Oops...", Common.CommonFunction.ErrorMessage, "error");
        }
        else
        {
            hfErrorMessage.Value = HttpUtility.HtmlEncode(errMessage);
            ScriptManager.RegisterStartupScript(this, this.GetType(), "ShowModal", "$('#modal_form_horizontal').modal('show');", true);
        }
    }
}

Option 2: Disable Request Validation (Not Recommended)

If you still want to disable request validation for this specific control, you can do so by setting the ValidateRequest attribute to false in the page directive and using the ValidateInput attribute in the method. However, this approach is not recommended due to security risks.

<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="YourPage.aspx.cs" Inherits="YourNamespace.YourPage" ValidateRequest="false" %>

[System.Web.Mvc.ValidateInput(false)]
protected void btnSubmit_Click(object sender, EventArgs e)
{
    // Your existing code
}

Using the first option (encoding the error message) is generally safer and recommended to avoid potential security vulnerabilities.

Thanks