Organizational Research By

Surprising Reserch Topic

in a text box in asp net how to allow it

in a text box in asp net how to allow it  using -',html-encode'

I have a textfield which displays a string which contains < and >. The code throws an error because of that. How can I allow the usage of those chars in my textfield?

Thanks :)

asked Oct 7, 2015 by sandeep bhadauria
0 votes

Related Hot Questions

7 Answers

0 votes

Problem is that when this gets posted to server, it will not work, doesn't matter what you try. This is the ASP.NET XSS protection, which can be disabled like so:

<%@ Page ... ValidateRequest="false" %>

Trouble is, you'll have to be very careful validating all the postback yourself. Easier way is to escape all the contents of textbox using javascript just before posting. You can escape it using same HTML escaping, then unescape in server side code.

Update: Example of escaping. This will flash the changed text on screen before postback - ideal solution is to use a hidden field for this, i.e. assign value to a hidden field, instead of that same field. This is the simplest version:

And in code-behind:

    "EscapeField", "EscapeField();")

Update: Again, warning - if you save HTML in your database like this, and then just display it to the client, you are directly vulnerable to XSS attacks. There are worms out there that will find and exploit your web site. Make sure you cleanse the HTML you are getting.

answered Oct 7, 2015 by bhavin
0 votes

If you're in an page, you can wrap the whole of the output text in a Server.HtmlEncode("YourTextWithCharacters")

function and it will encode any dodgy characters for you.

If, for some reason, you're doing this in a .cs file, you can use System.Web.HttpUtility.HtmlEncode("YourTextWithCharacters")

before passing it to the presentation layer.

answered Oct 7, 2015 by badhwar.rohit
0 votes

Convert them to < and >. In Html, < is converted to < and > is converted to > without it thinking it's part of the markup. So the string will be <Blah>.

Edit: I forgot, to automatically convert them and escape all HTML characters (so this isn't an issue for other things), in you can use Server.HtmlEncode(string) to automatically convert all characters that could cause issues to their HTML equivalent.

answered Oct 7, 2015 by yashwantpinge
0 votes

I don't know if your question is related to this or if you are getting a validateRequest issue

answered Oct 7, 2015 by patelnikul321
0 votes

You can either use the TextBox.Text property which will HTML-encode whatever you enter

or you can enter the html names for < and >.


or you can enter the html codes


for the name and code conversions, check out this chart.

answered Oct 7, 2015 by amit.gupta
0 votes

your problem is,you cannot use html tags in .net controls. so set the ValidateRequest="false" in your aspx page and encode the text before you saving the text.

    private string Encode(string text)
        byte[] encodedText = System.Text.Encoding.UTF8.GetBytes(text);
        return System.Convert.ToBase64String(encodedText);

when you retrieving your text make sure to decode the encoded text.

    // Decode:
    private string Decode(string encodedText)
        byte[] decodedText = System.Convert.FromBase64String(encodedText);
        return System.Text.Encoding.UTF8.GetString(decodedText );
answered Oct 7, 2015 by badhwar.rohit
0 votes

The easiest solution is to disable request validation in single pages

<%@ Page ... ValidateRequest="false" %>

but don't forget to enable requestValidationMode="2.0"


This solution could espose some threats.

Another smart solution is to replace via javascript text written by user to make it safe for validation: < tag> is considere dangerous, but is considered safe!

A javascript replacement can solve the problem.

function validateTxt() {
    $("textarea, input[type='text']").change(function () {
      html = $(this).val(); //get the value
      //.replace("a" , "b")  works only on first occurrence of "a"
      html = html.replace(/< /g, "<"); //before: if there's space after < remove
      html = html.replace(/
answered Oct 7, 2015 by vibhorsingh