Handle “potentially dangerous Request.Form value…”

Question

What's the best way to handle errors such as

A potentially dangerous Request.Form value was detected from the client"

in ASP.NET?

I'd like to keep the validation on, as my forms have no valid reasons to be allowing HTML characters. However, I'm not quite sure how to handle this error in a more friendly manner. I tried handling it in a Page_Error but, as far as I can tell, this occurs in a lower level section so the Page_Error function never fires.

Therefore, I may have to resort to using Application_Error in my Global.asax file. If this is the only way of handling that error, is there a way of specifically handling that one error? I don't want to handle all application errors in the same manner.

Thanks

Answer 1

You have two options:

// Editing your global.asax.cs
public class Global : System.Web.HttpApplication
{
    protected void Application_Error(object sender, EventArgs e)
    {
        Exception lastError = Server.GetLastError();
        if (lastError is HttpRequestValidationException)
        {
            Response.Redirect("~/RequestValidationError.aspx");
        }
    }
}

Or

// Editing your CUser.aspx.cs
public partial class CUser : System.Web.UI.Page
{
    protected override void OnError(EventArgs e)
    {
        Response.Redirect("~/RequestValidationError.aspx");
        Context.ClearError();
    }
}

Answer 2

You don't want to go adding unnecessary baggage to the Global.asax. If you're satisfied that this is caused by spurious data input, then deal with the input, no matter where it's coming from:

http://codersbarn.com/post/2008/11/01/ASPNET-Data-Input-Validation.aspx

Concentrate on the cause of the error :-)

Answer 3

You can use Server.GetLastError() in Application_Error to get the exception that was thrown, inspect the exception, and respond as you like to it (redirect to a page, etc)