Hi,

i have a screen which captures data and saves it in a database. I use the Request.ValidateInput() function to validate data. In case there is an error i redirect it to a custom error screen. all this works fine. my problem arrises when i click the "Back" button on the error screen. The earlier screen is loaded again and the malicious data get saved even though i call the Request.ValidateInput() function on page_load as well as the save button click event. I do not want to dissable the back button in the browser. How do I fix this problem ??

Regular Expression to Prevent Users Entering Malicious (HTML) Form Data

very nice. this helped me out with my problem. I could not catch this HttpRequestValidationException exception anywhere except in the Application_error but with this i can. Im using updatepanel with a textbox. any suggestions otherwise?

Hoi buur,

After looking into the potentially dangerous "problem" my self. I think this solution is great for catching the error.

But there is still the problem of what happens when you want to have some "potentially dangerous" information (like when you use a WYSIWYG editor)

Where is my fix:

/**

* Created By: Warnar Boekkooi

* Usage whin the page class:

public override void ProcessRequest(HttpContext context)

{

   //escape form for parts (because we trust them?)

   string[] unescapeFormParts = context.Request.escapeFormParts("txtMessage");

   this.PreInit += delegate { Page.Request.unescapeFormParts(unescapeFormParts); };

   //Continue proccessing request

   base.ProcessRequest(context);

}

**/

using System.Collections.Generic;

using System.Collections.Specialized;

using System.Reflection;

using System.Web;

using System.Linq;

using System.Web.UI;

namespace DashboardWiki.App_Library

{

   public static class HttpRequestEx

   {

       #region extention method's

       public static void EscapeFormParts(this Page page, params string[] fields)

       {

           //First call the collection to make sure it is filled

           NameValueCollection tmp = page.Request.Form;

           //escape form for parts (because we trust them?)

           string[] unescapeFormParts = escape(page.Request, "_form", fields);

           //Register unescape to the PreInit event

           page.PreInit += delegate { unescape(page.Request, "_form", unescapeFormParts); };

       }

       public static void EscapeQueryStringParts(this Page page, params string[] fields)

       {

           //First call the collection to make sure it is filled

           NameValueCollection tmp = page.Request.QueryString;

           //escape form for parts (because we trust them?)

           string[] unescapeFormParts = escape(page.Request, "_queryString", fields);

           //Register unescape to the PreInit event

           page.PreInit += delegate { unescape(page.Request, "_queryString", unescapeFormParts); };

       }

       #endregion

       #region the source of all evil

       private static string[] escape(HttpRequest request, string collectionVariable, IEnumerable<string> fields)

       {

           //Get the (private) version of the collection

           NameValueCollection col = (NameValueCollection)request.GetType().GetField(collectionVariable, BindingFlags.NonPublic | BindingFlags.Instance).GetValue(request);

           //Make collection writeable (by getting the readOnly property and setting it to false)

           PropertyInfo oReadable = col.GetType().GetProperty("IsReadOnly", BindingFlags.NonPublic | BindingFlags.Instance);

           oReadable.SetValue(col, false, null);

           //Fix values (By escaping them)

           List<string> changedKeys = new List<string>();

           foreach (string s in fields)

           {

               var requestKeys = from ck in col.AllKeys where ck.EndsWith("$" + s) select ck;

               foreach (string requestKey in requestKeys)

               {

                   col[requestKey] = HttpUtility.HtmlEncode(col[requestKey]);

                   changedKeys.Add(requestKey);

               }

           }

           //Make Form read only again

           oReadable.SetValue(col, true, null);

           //

           return changedKeys.ToArray();

       }

       private static void unescape(HttpRequest request, string collectionVariable, IEnumerable<string> formKeys)

       {

           //Get the (private) version of the collection

           NameValueCollection col = (NameValueCollection)request.GetType().GetField(collectionVariable, BindingFlags.NonPublic | BindingFlags.Instance).GetValue(request);

           //Make collection writeable (by getting the readOnly property and setting it to false)

           PropertyInfo oReadable = col.GetType().GetProperty("IsReadOnly", BindingFlags.NonPublic | BindingFlags.Instance);

           oReadable.SetValue(col, false, null);

           //Fix values (By escaping them)

           foreach (string formKey in formKeys)

           {

               col[formKey] = HttpUtility.HtmlDecode(col[formKey]);

           }

           //Make Form read only again

           oReadable.SetValue(col, true, null);

       }

       #endregion

   }

}