Potentially dangerous Request.Form value was detected from the client

'A Potentially dangerous Request.Form value was detected from the client'

This is a common error that ASP.NET developers have run into many times. We will see in this post a few ways on how to avoid it. 

Reason

       By default, ASP.NET performs request validation to prevent people from uploading HTML markup or script to your site. ASP.NET checks the content of the form sent to the server to prevent cross-site scripting(xss).  

This error is caused by a newly introduced feature of .NET Framework 1.1, called "Request Validation."  This feature is designed to help prevent script-injection attacks whereby client script code or HTML is unknowingly submitted to a server, stored, and then presented to other users.

Note that anything between '<' and '>' is considered dangerous, and it doesn't have to necessarily closes the tag with '<' ("<a" would have be considered potentially dangerous). ASP.NET validates query string as well.

Try it:

To overcome this error first try to disable the request validation feature, because the validation is done by ASP.NET before any of your code.

<%@ Page ValidateRequest="false" %>

Or you can disable it for your entire application in the web.config file:

<configuration>

    <system.web>

        <pages validateRequest="false" />

    </system.web>

</configuration>

ASP.Net 4.0?

        In ASP.Net 2.0, request validation is enabled for only ASP.Net pages and validated when those pages are executing. Whereas in ASP.Net 4.0, by default request validation is enabled for all requests. As a result validation applies to not only to ASP.Net pages but also to the Web service calls, Http handlers etc.. To prevent this error simply revert ASP.Net behavior back to 2.0. 
To do this, add a configuration element in Web.Config.

<httpRuntime requestValidationMode="2.0" />

CodeProject

Image upload with CKEditor

CKeditor is one of the most widely used WYSIWYG editors for web applications. Overtime, the CKeditor continued to evolve by adding new features that made HTML text editing a lot easier. When using a WYSIWYG editor, we will often need to upload image to server and embed it in the HTML content. By default, the CKeditor will support embedding an image that are already uploaded or from an external source by providing its URL.

In this article, let’s see how we can upload image to our website and embed it in CKeditor by below easy solution. The CKeditor has a property called filebrowserImageUploadUrl which will provide an option to upload images to the server when configured. This property takes a file uploader (a page or a handler) url to upload the selected image to the server. The handler that is responsible for uploading the image should return back the URL of the image to display in the CKeditor. Once filebrowserImageUploadUrl property is configured, you will be able to see a new tab called “Upload” in Image Properties pop-up of CKeditor.

Follow the below steps to integrate image upload functionality with CKEditor in ASP.NET. Here the solution.

1. Create a New ASP.NET Website “CKeditorDemo”.
2.  Download CKEditor and extract in your web folder root.

3. Create a new folder named “Images” in your web folder root.

4. Add the new ASHX Handler file (.ashx) “Upload.ashx” and Copy Paste below code into “Upload.ashx”

<%@ WebHandler Language="C#" Class="Upload" %>

using System;

using System.Web;

public class Upload : IHttpHandler {   

    public void ProcessRequest (HttpContext context) {

       HttpPostedFile uploads = context.Request.Files["upload"];

       string CKEditorFuncNum = context.Request["CKEditorFuncNum"];

       string file = System.IO.Path.GetFileName(uploads.FileName);

       uploads.SaveAs(context.Server.MapPath(".") + "\\Images\\" + file);

//provide direct URL here

       string url = "http://localhost/CKeditorDemo/Images/" + file; 

       

context.Response.Write("<script>window.parent.CKEDITOR.tools.callFunction(" +                                             CKEditorFuncNum + ", \"" + url + "\");</script>");

       context.Response.End();            

    }

    public bool IsReusable {

        get { return false; }

    }

}

5. Call the script and declare Textbox with ID="txtCkEditor" in .aspx file

<script type="text/javascript" src="Scripts/jquery-1.4.1.min.js"></script>

<script type="text/javascript" src="ckeditor/ckeditor.js"></script>

<script type="text/javascript" src="ckeditor/adapters/jquery.js"></script>

<script type="text/javascript">

    $(function () {

CKEDITOR.replace('<%=txtCkEditor.ClientID %>', { filebrowserImageUploadUrl:  '/CKeditorDemo/Upload.ashx' }); //path to “Upload.ashx”

    });

</script>

<asp:TextBox ID="txtCkEditor" TextMode="MultiLine" runat="server"></asp:TextBox>

6. You are done with the setting. Now run the website you will see the CKEditor configured in the page.

7. Then choose the image icon in the CKEditor to upload the Image.

8. Select the image by clicking Browse button in Upload tab and select “Send it to the Server” button to save the image in server.

9. The uploaded image is displayed in the CKEditor after clicking “OK”.

CodeProject

HTML Codes for Punctuation and Other Characters

HTML codes to put punctuation characters on your Web page

The following list includes the HTML codes for punctuation characters not in the standard character set. Not all browsers support all the codes, so be sure to test your HTML codes before you use them.
Some punctuation characters are part of the Unicode character set, so you need to declare that in the head of your documents:

<meta http-equiv="content-type" content="text/html;charset=utf-8" />

Display	Friendly Code	Numerical Code	Hex Code	Description
						Horizontal Tab
		
		Line Feed
		 	 	Space
!	!	!	!	Exclamation Point
"	"	"	"	Double Quote
#	#	#	#	Number Sign
&	&	&	&	Ampersand
'	'	'	'	Single Quote
(	(	(	(	Left Parenthesis
)	)	)	)	Right Parenthesis
*	*	*	*	Asterisk (Star)
,	,	,	,	Comma
-	-	-	-	Hyphen
.	.	.	.	Period
/	/	/	/	Forward Slash
:	:	:	:	Colon
;	;	&#59;	&#x3B;	Semi-Colon
?	?	?	?	Question Mark
@	@	@	@	At Sign
[	[	[	[	Left Square Bracket
\	\	\	\	Back Slash
]	]	]	]	Right Square Bracket
^	^	^	^	Caret
_	_	_	_	Underscore
{	{	{	{	Left Curly Brace
|	|	|	|	Vertical Bar
}	}	}	}	Right Curly Brace
~	˜	~	~	Vertical Bar
‚	‚	‚	‚	Single Low Quote
„	&dbquo;	„	„	Double Low Quote
…		…	…	Elipsis
†	†	†	†	Dagger
‡	‡	‡	‡	Double Dagger
‹	‹	‹	‹	Left Single Angle Quote
‘	‘	‘	‘	Left Single Quote
’	’	’	’	Right Single Quote
“	“	“	“	Left Double Quote
”	”	”	”	Right Double Quote
•		•	•	Small Bullet
–	–	–	–	En Dash
—	—	—	—	Em Dash
™	™	™	™	Trademark
›	›	›	›	Right Single Angle Quote
	 	 	 	Non-Breaking Space
¡	¡	¡	¡	Inverted Exclamation Point
¦	¦	¦	¦	Broken Vertical Bar
©	©	©	©	Copyright
ª	ª	ª	ª	Feminine Ordinal Indicator
«	«	«	«	Left Angle Quote
¬	¬	¬	¬	Not Sign
­	­	­	­	Soft Hyphen
®	®	®	®	Registered Symbol
°	°	°	°	Degree
²	²	²	²	Superscript 2
³	³	³	³	Superscript 3
µ	µ	µ	µ	Micro Sign
¶	¶	¶	¶	Pilcrow (Paragraph Sign)
·	·	·	·	Middle Dot
¹	¹	¹	¹	Superscript 1
º	º	º	º	Masculine Ordinal Indicator
»	»	»	»	Right Angle Quote
¿	¿	¿	¿	Inverted Question Mark
℅		℅	℅	Care Of
ⁿ		ⁿ	ⁿ	Superscript N
§	§	§	§	Section Mark
¨	¿	¿	¿	Inverted Question Mark
―		―	―	Horizontal Bar
‣		‣	‣	Triangle Bullet
‾	‾	‾	‾	Overline
‼		‼	‼	Double Exclamation Point
№		№	№	Number Word

Other Character Codes

Note: not all of these characters will display on every browser, be sure to test before you rely on them for your Web site.

Display	Friendly Code	Numerical Code	Hex Code	Description
♠	♠	♠	♠	Spade card suit
♣	♣	♣	♣	Clubs card suit
♦	♦	♦	♦	Diamonds card suit
♥	♥	♥	♥	Hearts card suit
←	←	←	←	Left arrow
→	→	→	→	Right arrow
↑	↑	↑	↑	Up arrow
↓	↓	↓	↓	Down arrow
♀		♀	♀	Female Indicator
♂		♂	♂	Male Indicator
♩		♩	♩	Quarter Note
♪		♪	♪	Eighth Note
♬		♬	♬	Two Eighth Notes
♭		♭	♭	Flat
♯		♯	♯	Sharp