In some scenario, we need to send HTML value/content as input to our application from the view to the controller. In some time we use HTML Editors to save the HTML content if the end user accept. By default, ASP.NET MVC framework prevents you from submitting the HTML content/potentially malicious content to the controller, for avoiding the cross site scripting attack. This feature is called request validation.
Used Version Detail : Visual studio 2013, Version 4.5, MVC 5
This is the simple ValideInput controller and it will render the view as output. And in the form submission, it will redirect to GetDescription() action and bind the view. In default, ValidateInput attribute parameter is true (ValidateInput(true)).
Here it is the view for getting the form data from the user, which contain one textbox and submit button inside the BeginForm. After user submission it will redirect to the GetDescription action method inside the dotnethelpers controller.
As per below screen, we are entering a content with HTML elements. And once we click on the submit button, then it will throw the error as like below because, in default ASP.NET MVC prevents the HTML element as form data. In simple, ASP.NET MVC cannot send HTML values to the controller.
This is not an issue, it is default security validation handling by the ASP.NET MVC. In some scenario we need to override this security by using the ValidateInput attribute to prevent HTML explicitly.
Implementing ValidateInput attribute:
In default, ValidateInput parameter is true (ValidateInput(true).
<h1>GetDescription View:Making validation using ValidateInput(false)attribute</h1>
Run the application and apply the Html element as input (Ex : http://localhost:62536/dotnethelpers/ValideInput). Now its redirect to the “GetDescription View” instead of throwing the potential error as shown below.