https://wiki.owasp.org/api.php?action=feedcontributions&feedformat=atom&user=Alexandre+Herzog 2026-05-16T15:59:21Z User contributions MediaWiki 1.27.2 https://wiki.owasp.org/index.php?title=ASP.NET_Request_Validation&diff=102701 2011-01-31T14:04:36Z

<p>Alexandre Herzog: &lt;? is also considered as a dangerous tag in ASP.NET 2.0</p> <hr /> <div>ASP.NET Provides built-in request validation on form submission or postback handling. Request validation is on by default, and is handled differently by versions of the framework. <br /> <br /> ==ASP.NET 1.1 Request Validation Summary==<br /> <br /> *Filter &quot;&amp;#&quot;<br /> *Filter ‘&lt;’ then alphas or ! or / (tags)<br /> *Filter &quot;script:&quot;<br /> *Filter on handlers (onXXX=)<br /> *Filter “expression(“<br /> *Ignore elements named &quot;__VIEWSTATE&quot;<br /> <br /> <br /> ==ASP.NET 2.0 Request Validation Summary==<br /> <br /> *Filter &quot;&amp;#&quot;<br /> *Filter ‘&lt;’ then alphas or ! or / or ? (tags)<br /> *Ignore elements with names prefixed with double underscore (__)<br /> <br /> <br /> ==ValidateRequest Setting==<br /> ===To toggle request validation (it is set to true by default):===<br /> <br /> On a single page:<br /> <br /> &lt;%@ Page validateRequest=&quot;true|false&quot; %&gt;<br /> <br /> For the entire application:<br /> <br /> &lt;configuration&gt;<br /> &lt;system.web&gt;<br /> &lt;pages validateRequest=&quot;true|false&quot; /&gt;<br /> &lt;/system.web&gt;<br /> &lt;/configuration&gt;<br /> <br /> ===References===<br /> [http://phed.org/2008/04/23/aspnet-20-dumbs-down-request-validation/ ASP.NET 2.0 dumb’s down request validation (by Michael Eddington)]<br /> <br /> [http://keepitlocked.net/archive/2007/10/30/asp-net-validaterequest-and-the-html-attribute-based-cross-site-scripting.aspx ASP.NET ValidateRequest and the HTML Attribute Based Cross Site Scripting]<br /> <br /> [[Category:OWASP .NET Project]]</div>

Alexandre Herzog