By default, the ASP.NET MVC framework prevents you from submitting form data that contains potentially malicious content. This feature is called request validation.

For example, submitting the following text in an HTML input field causes the ASP.NET MVC framework to throw an exception (Figure 1):

<script>Alert(‘I am evil!’);</script>

Figure 1 – An evil form post

This is a good feature. You don't want people sneaking scripts into your website that can steal passwords or other sensitive user information. Normally, you want to leave request validation enabled.

There are situations, however, when it is perfectly legitimate to want people to submit text that contains HTML markup to a website. For example, you might be hosting a discussion forum on ASP.NET MVC and you want to enable people to submit messages that contain HTML tags.

Unlike a Web Forms application, you cannot disable request validation by using the <%@ Page ValidateRequest=”false” %> directive. You also cannot disable request validation in the web configuration (web.config) file. If you want to disable request validation then you must use the [ValidateInput] attribute.

You apply the [ValidateInput] attribute to the controller action that accepts the form input. For example, the Create() action below has request validation disabled:

[C#]

//
// POST: /Home/Create
 
[ValidateInput(false)]
[AcceptVerbs(HttpVerbs.Post)]
public ActionResult Create([Bind(Exclude="Id")]Product productToCreate)
{
    if (!ModelState.IsValid)
        return View();

    try
    {
        _dataModel.AddToProductSet(productToCreate);
        _dataModel.SaveChanges();

        return RedirectToAction("Index");
    }
    catch
    {
        return View();
    }
}

[VB]

'
' POST: /Home/Create
<ValidateInput(false)> _
<AcceptVerbs(HttpVerbs.Post)> _
Function Create(<Bind(Exclude:="Id")> ByVal productToCreate As Product) As ActionResult

    If Not ModelState.IsValid Then
        Return View()
    End If

    Try
        _dataModel.AddToProductSet(productToCreate)
        _dataModel.SaveChanges()

        Return RedirectToAction("Index")
    Catch
        Return View()
    End Try
End Function

If you decide to disable request validation, make sure that you HTML encode any text submitted by a user that you display in a view. Always use the <%= Html.Encode() %> helper method when displaying content.