Showing posts with label errors. Show all posts
Showing posts with label errors. Show all posts

A potentially dangerous Request.Form value was detected from the client


Above error comes because by default ASP.Net blocks the possible Script Injection request. e.g. if user type <script>alert('yes');</script> in your text box and when you display the text in text box, this java script will be executed instead of displaying text.

To resolve this problem you need to keep few things in mind:-

1- We can remove HTML Tags from TextBoxes with a simple regular expression filter like this:-
<asp:textbox id="txtSecureTextBox" runat="server" onblur="this.value = this.value.replace(/&lt;\/?[^>]+>/gi, '');">

2- Add ValidateRequest="false" in your Page directive line incase you want to disable this on single page.
<%@ Page Language="C#" AutoEventWireup="true" ValidateRequest="false"/>

3- Incase you want to disable validation through out the site then you can do it in your web.config file like this:-
<configuration>  
  <system.web>  
    <pages validateRequest="false" />  
  </system.web> 
</configuration>

4- Use HTMLEncode whenever you are displaying unsafe contents in labels like this:-
Label1.Text = Server.HtmlEncode(TextBox1.Text) 

For further details see Request Validation - Preventing Script Attacks.

System.UnauthorizedAccessException: Access to the path 'C:\inetpub\wwwroot\...' is denied


This exception is a very common exception. It usually occurs when we move our application to IIS server (usually on production environment).

This exception occurs because IIS uses ASP .Net (IIS_IUser in Vista) user account and ASP .Net is not authorized to access that location.

To give a quick fix to this, follow these steps:-

  1. Give read/write rights to ASP.NET user to C:\Inetpub\yourfolder\ folder:-
    1. Right Click on FOlder and Select Properties
    2. Go to Security Tab
    3. Click Add, then click Location.
    4. Select your pc name, usually first item.
    5. Press Ok, then press advance and then Find Now.
    6. Select ASP.NET user if not exist then select Authenticated Users.
    7. Press Ok. And Select Read/Write/Modify/List Folder Contents.
  2. Go to IIS->WebSites->DefaultWebSite->YourSiteName->Properties, and at Virtual Directory Tab check 'Read' and 'Write' button.