ASP.NET

'A potentially dangerous Request.Form value was detected' in ASP.NET

ASP.NET · By the Postback Notes editorial team · Published 2026-08-18

A user types <b>bold</b> or <3 into a text box, clicks Save, and gets a yellow error page: "A potentially dangerous Request.Form value was detected from the client". This is request validation, a safety net that blocks input looking like HTML markup. The right response is to allow such input only where you need it, and to handle it safely.

What triggers it

Request validation inspects form fields, query strings and cookies for patterns such as < followed by a letter, !, / or ?, and &#. Ordinary text with a lone < followed by a space or digit passes; <script>, <b> and <!-- do not. The exception is HttpRequestValidationException.

Allow HTML for one control (.NET 4.5+)

<!-- web.config: keep the modern validation mode -->
<system.web>
  <httpRuntime targetFramework="4.8" requestValidationMode="4.5" />
</system.web>
<asp:TextBox ID="txtBody" runat="server" TextMode="MultiLine" ValidateRequestMode="Disabled" />

With validation mode 4.5, values are validated lazily, when your code reads them, and ValidateRequestMode="Disabled" exempts just this control. Everything else on the page stays protected. In code, Request.Unvalidated.Form["field"] reads a raw value without triggering validation.

Avoid the old blanket fixes: ValidateRequest="false" on the whole page and requestValidationMode="2.0" in web.config, which weakens every page of the application.

Then make the HTML safe

Request validation was protecting you from storing and displaying script. Once you accept markup, that job is yours:

protected void btnSave_Click(object sender, EventArgs e)
{
    string raw = txtBody.Text;                    // allowed through for this control only
    string safe = HtmlSanitizerService.Clean(raw); // e.g. a maintained allow-list sanitiser library
    CommentRepository.Save(safe);
}

Showing a friendly message instead of the error page

// Global.asax.cs
protected void Application_Error(object sender, EventArgs e)
{
    if (Server.GetLastError() is HttpRequestValidationException)
    {
        Server.ClearError();
        Response.Redirect("~/Errors/InvalidInput.aspx", false);
        Context.ApplicationInstance.CompleteRequest();
    }
}

ASP.NET Core

ASP.NET Core has no request validation. Razor encodes output by default, which is the primary defence; sanitising rich text is still your responsibility.

Other errors met when moving an application: Parser Error when deploying.

Official documentation