Potentially dangerous Request.Form value was detected from the client

'A Potentially dangerous Request.Form value was detected from the client'

This is a common error that ASP.NET developers have run into many times. We will see in this post a few ways on how to avoid it. 

Reason

       By default, ASP.NET performs request validation to prevent people from uploading HTML markup or script to your site. ASP.NET checks the content of the form sent to the server to prevent cross-site scripting(xss).  

This error is caused by a newly introduced feature of .NET Framework 1.1, called "Request Validation."  This feature is designed to help prevent script-injection attacks whereby client script code or HTML is unknowingly submitted to a server, stored, and then presented to other users.

Note that anything between '<' and '>' is considered dangerous, and it doesn't have to necessarily closes the tag with '<' ("<a" would have be considered potentially dangerous). ASP.NET validates query string as well.

Try it:

To overcome this error first try to disable the request validation feature, because the validation is done by ASP.NET before any of your code.

<%@ Page ValidateRequest="false" %>

Or you can disable it for your entire application in the web.config file:

<configuration>

    <system.web>

        <pages validateRequest="false" />

    </system.web>

</configuration>

ASP.Net 4.0?

        In ASP.Net 2.0, request validation is enabled for only ASP.Net pages and validated when those pages are executing. Whereas in ASP.Net 4.0, by default request validation is enabled for all requests. As a result validation applies to not only to ASP.Net pages but also to the Web service calls, Http handlers etc.. To prevent this error simply revert ASP.Net behavior back to 2.0. 
To do this, add a configuration element in Web.Config.

<httpRuntime requestValidationMode="2.0" />

CodeProject

Image upload with CKEditor

CKeditor is one of the most widely used WYSIWYG editors for web applications. Overtime, the CKeditor continued to evolve by adding new features that made HTML text editing a lot easier. When using a WYSIWYG editor, we will often need to upload image to server and embed it in the HTML content. By default, the CKeditor will support embedding an image that are already uploaded or from an external source by providing its URL.

In this article, let’s see how we can upload image to our website and embed it in CKeditor by below easy solution. The CKeditor has a property called filebrowserImageUploadUrl which will provide an option to upload images to the server when configured. This property takes a file uploader (a page or a handler) url to upload the selected image to the server. The handler that is responsible for uploading the image should return back the URL of the image to display in the CKeditor. Once filebrowserImageUploadUrl property is configured, you will be able to see a new tab called “Upload” in Image Properties pop-up of CKeditor.

Follow the below steps to integrate image upload functionality with CKEditor in ASP.NET. Here the solution.

1. Create a New ASP.NET Website “CKeditorDemo”.
2.  Download CKEditor and extract in your web folder root.

3. Create a new folder named “Images” in your web folder root.

4. Add the new ASHX Handler file (.ashx) “Upload.ashx” and Copy Paste below code into “Upload.ashx”

<%@ WebHandler Language="C#" Class="Upload" %>

using System;

using System.Web;

public class Upload : IHttpHandler {   

    public void ProcessRequest (HttpContext context) {

       HttpPostedFile uploads = context.Request.Files["upload"];

       string CKEditorFuncNum = context.Request["CKEditorFuncNum"];

       string file = System.IO.Path.GetFileName(uploads.FileName);

       uploads.SaveAs(context.Server.MapPath(".") + "\\Images\\" + file);

//provide direct URL here

       string url = "http://localhost/CKeditorDemo/Images/" + file; 

       

context.Response.Write("<script>window.parent.CKEDITOR.tools.callFunction(" +                                             CKEditorFuncNum + ", \"" + url + "\");</script>");

       context.Response.End();            

    }

    public bool IsReusable {

        get { return false; }

    }

}

5. Call the script and declare Textbox with ID="txtCkEditor" in .aspx file

<script type="text/javascript" src="Scripts/jquery-1.4.1.min.js"></script>

<script type="text/javascript" src="ckeditor/ckeditor.js"></script>

<script type="text/javascript" src="ckeditor/adapters/jquery.js"></script>

<script type="text/javascript">

    $(function () {

CKEDITOR.replace('<%=txtCkEditor.ClientID %>', { filebrowserImageUploadUrl:  '/CKeditorDemo/Upload.ashx' }); //path to “Upload.ashx”

    });

</script>

<asp:TextBox ID="txtCkEditor" TextMode="MultiLine" runat="server"></asp:TextBox>

6. You are done with the setting. Now run the website you will see the CKEditor configured in the page.

7. Then choose the image icon in the CKEditor to upload the Image.

8. Select the image by clicking Browse button in Upload tab and select “Send it to the Server” button to save the image in server.

9. The uploaded image is displayed in the CKEditor after clicking “OK”.

CodeProject

Disable back button via javascript

For disabling the back button functionality in the browser
Use this code on the master page

 <script type="text/javascript">
function noBack() {
window.history.forward()
}
noBack();
window.onload = noBack;
window.onpageshow = function (evt) { if (evt.persisted) noBack() }
window.onunload = function () { void (0) }
</script>