List of reserved HTML characters? 1

[tcstom]

I have an application that occasionally errors on postback because a user has included reserved HTML characters in one of the many forms. I don't want to set Page.ValidateRequest to false in this case because security of this system is important, so for now I just want to provide users with a list of characters to avoid. Can someone list these for me, or is it just < and > ?

 

[AlexCuse]

Do you mean these:

http://www.december.com/html/spec/esccodes.html

Perhaps it would be better to just encode the form values before building your URL if that is the case, and let users enter whatever they want?

Hope this helps,

Alex

[small]----signature below----[/small]
Majority rule don't work in mental institutions

My Crummy Web Page

 

[tcstom]

Eventually I'll encode any submitted HTML but I just don't have time now so I just want to warn users about characters that'll cause the request validation to fail. Thanks for the list, Alex. At a glance I'm guessing only the < and > characters will actually create a request validation exception. Anyone know if I'm right?

 

[ca8msm]

Bear in mind that the list is dependent on which DOCTYPE you have chosen for your page...


-------------------------------------------------------

Mark,
[URL unfurl="true"]http://aspnetlibrary.com[/url]
[URL unfurl="true"]http://mdssolutions.co.uk[/url] - Delivering professional ASP.NET solutions
[URL unfurl="true"]http://weblogs.asp.net/marksmith[/url]

 

[AlexCuse]

I've not used this before, but it looks like it may be useful:

http://msdn2.microsoft.com/en-us/library/zttxte6w(VS.80).aspx

Decoding it looks rather simple as well.

Hope this helps,

Alex

[small]----signature below----[/small]
Majority rule don't work in mental institutions

My Crummy Web Page

 

[tcstom]

Just to clarify, applying Server.UrlEncode replaces certain characters with URL-friendly equivalents (as per Alex's link above,

http://www.december.com/html/spec/esccodes.html)

so < is replaced with %3C. This should be used when passing text in a query string (and note that the values are decoded automatically when parsing that query string). On the other hand, Server.HtmlEncode should be used when handling form submissions safely because it replaces HTML-specific characters with their XML entity equivalents (so in this case < is replaced with &lt. It is these characters that often cause the ASP.NET request validation to fail and I was originally asking for a list of the specific characters that would cause this (i.e. not a list of the URL-friendly ones). Does anyone have such a list?

 

[ca8msm]

Do a search on google for "html entities" and you will find many lists. Also bear in mind the DOCTYPE issue I mentioned above.


-------------------------------------------------------

Mark,
[URL unfurl="true"]http://aspnetlibrary.com[/url]
[URL unfurl="true"]http://mdssolutions.co.uk[/url] - Delivering professional ASP.NET solutions
[URL unfurl="true"]http://weblogs.asp.net/marksmith[/url]

 

[tcstom]

Thanks, but I only want to know which ones will cause the request validation to fail. For example, the symbol & is represented by the HTML entity &amp; but submitting & in a textbox will not cause the request validation to fail.

 

[ca8msm]

You will have to read the specific documentation for whichever DOCTYPE you have chosen as I guess the list of values will change depending on which one you have chosen.


-------------------------------------------------------

Mark,
[URL unfurl="true"]http://aspnetlibrary.com[/url]
[URL unfurl="true"]http://mdssolutions.co.uk[/url] - Delivering professional ASP.NET solutions
[URL unfurl="true"]http://weblogs.asp.net/marksmith[/url]