Ability to fine-tune control over request validation

This is a subject that crosses multiple disciplines, but I'm posting it here (AJAX forum) because it was a partial postback (with Sys.Webforms.PageRequestManagerServerErrorException error) that stumped me.

I have a form that submits regular <input /> tags inside an UpdatePanel (not server controls). I was finishing debugging when I tried submitting something like "test<test>test" for a form value. The page would not do the partial update, and instead threw the error mentioned earlier in an alert box.

After messing around I figured out that it is ASP.NET guarding me against some malicious entry by hackers.

Changing ValidateRequest to false fixed the problem, but I hate to wipe something out completely, without knowing what I'm wiping out.

Is there some way to fine-tune control of what gets validated? Is there any way to know exactly what I've just disabled by setting ValidateRequest to false?

Thanks...

I'll give this one obnoxious bump, just to see if there's someone who may have some knowledge on this topic. If not, maybe it's just one of those areas where MS doesn't want to say what's going on under the covers. It would be nice to know what is going on with the validation, and what, if anything, can be controlled. For example, it would be great to subclass the functionality.

Hi,

It checks the following strings:

1. Is there a "&#" contained in the input string

2. Is there a "<[char]", "<!", "</" in the input string.

Great, thanks Raymond!

A runtime error has occurred. Do you wish to debug ? Help

I get the subject error when i try to run sample asp.net ajax aps and even some day to day web pages. It seems to be "an unhandled exception (persmission denied" and "Jscript runtime error: Permission denied"

Simple error but I must be simple minded. What is going on?

Thanks for any help Pauley

;

hello.
you must give us more info if you want us to help you.

Hello Luis, thanks for responding. I think I am ok, I found a post to change advanced settings in Internet Explorer to NOT give a notice of script error. I did and I think I am ok now. I assume there are flaws in some code which IE exposes when it runs and that caused the error message.

Thank you.

hello.

you shouldn't do that. in fact, you should do the opposite in order to be notified about all the errors on your pages. if you're getting an exceptio, then believe me: there's something wrong with your code!