ASP.NET MVC2 on .NET 4.0: is [ValidateInput(false)] enough?
-
16-10-2019 - |
Question
Good day!
I plan to upgrade my ASP.NET MVC 2 application to .NET 4.0, and have a couple of questions:
Is having
[ValidateInput(false)]
on action enough to accept HTML, or I need to set<httpRuntime requestValidationMode="2.0"/>
as described here: ASP.NET 4 Breaking ChangesHow it will work if I upgrade ASP.NET MVC to version 3 (in addition to uprading to .NET 4.0)?
Thanks in advance!
Solution
- You need to set
<httpRuntime requestValidationMode="2.0"/>
as well in ASP.NET 4.0. The same as in ASP.NET MVC 2 (.NET 4.0) but in addition you have more fine grained control with the
[AllowHtml]
attribute which could be placed on a single property of your view model instead of disabling validation for the entire request:public class MyViewModel { [AllowHtml] public string SomeHtmlProperty { get; set; } public string SomeOtherProperty { get; set; } }
and have a controller action like this:
[HttpPost]
public ActionResult Update(MyViewModel model) { ... }
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow