Dynamically-assigning string to text box causes "A potentially dangerous Request.Form value was detected from the client" error

Question

I have an ASP.NET web form that allows a user to send an e-mail from inside my application. The form contains three text boxes, a file upload control, and a button for sending the e-mail.

Mailmessage.value = ;

When I comment out the above line and replace it with "Mailmessage.Value = "Some string";", my program works fine.

The above is contained inside of a click event handler named "EmailButton_Click". I've tried all of the solutions outlined in the following article, but none of them solved my problem: http://www.aspsnippets.com/Articles/ASPNet-Error-A-potentially-dangerous-RequestForm-value-was-detected-from-the-client.aspx

Thanks in advance for your help.

Answer 1

Set the validate request to false in the aspx page you are calling the method.

ValidateRequest = "false"

and construct your message like this

 StringBuilder msg =  new StringBuilder();

 msg.Append(Environment.NewLine);
 msg.Append(Environment.NewLine);
 msg.Append(Environment.NewLine);
 msg.Append("Issue ID: ");
 msg.Append(Session["IssueID"].ToString());
 msg.Append(Environment.NewLine);
 msg.Append("Issue Name: ");
 msg.Append(Session["IssueName"].ToString());
 msg.Append(Environment.NewLine);
 msg.Append(Environment.NewLine);
 msg.Append("Please do not reply to this message. Replies to this message are routed to an unmonitored mailbox. If you have questions or comments, please contact ");
 msg.Append(Session["UserFullName"].ToString());
 msg.Append(" at \"");
 msg.Append(Session["UserEmailAddress"].ToString());
 msg.Append("CONFIDENTIALITY NOTICE: This communication with its contents may contain confidential and/or legally privileged information. It is solely for the use of the intended recipient(s). Unauthorized interception, review, use, forwarding or disclosure is prohibited and may violate applicable laws including the Electronic Communications Privacy Act. If you are not the intended recipient, please contact the sender and destroy all copies of the communication.");

 Mailmessage.Value = msg.ToString();