[*resolved]how can I detect and convert html tags to text?

[MrPolite]

lets say I have a textbox and the user enters some html tags in it. I want those to show up as text (well asp engine gives me an error if I enter html tags when submitting the value of the textbox). php had a simple function that converted all those to simple text. what should I do in asp.net?

[powdir]

If i understand you correctly the Server.HTMLEncode method should be able to help you out here - that help for a start?

Cheers

[MrPolite]

Originally posted by powdir
If i understand you correctly the Server.HTMLEncode method should be able to help you out here - that help for a start?

Cheers

hmm well I dont know how to use it. As soon as the page is submitted, before the click event for my button fires, I get the error message: A potentially dangerous Request.Form value was detected from the client (txtMessage="...dasdasdf <br>").


how can I fix this?
Here's all my page does: there is a textbox, and a button that shows teh content of the textbox in a label. Now if the user enters html tags in the textbox I get that error.... dunno how I can use the htmlencode function

[DevGrp]

Thats the new security in ASP.NET 1.1. To bypass it just put ValidateRequest="false" in the @Page attribute of the page that is is throwing the exception.

[powdir]

...something like

    dim str as string
    str = Server.HTMLEncode(MyTextBox.text)

lets say your textbox (MyTextBox) has contains tags - which yours does - the above function will apply encoding to the contents, preventing malicious upload of HTML.

So....

    dim str as string
    str = Server.HTMLEncode("<P>") 'paragraph tag will output as &lt;P&gt;

likewise Server.HTMLDecode does the opposite

That help?

Cheers

[MrPolite]

Originally posted by powdir
...something like

    dim str as string
    str = Server.HTMLEncode(MyTextBox.text)

lets say your textbox (MyTextBox) has contains tags - which yours does - the above function will apply encoding to the contents, preventing malicious upload of HTML.

So....

    dim str as string
    str = Server.HTMLEncode("<P>") 'paragraph tag will output as &lt;P&gt;

likewise Server.HTMLDecode does the opposite

That help?

Cheers

umm well ok I'm sure there is nothign wrong with that line of code, but the problem is that the compiler never actually runs the code, it gives me the error before it would fire any events.

just try this, put a textbox and a button on a project. run it, and type a <br> in the textbox. when you press the button and the textbox's contents are submitted you'll get an error

I'm sure there is a simple solution to this, I just dunno how to get around it because I'm new to asp

so I'm talking about 2 problems in this post
1- how to convert those tags to plain text -> you answered me, htmlEncode(), thanks
2- how to aviod that error -> still dunno

[DevGrp]

Originally posted by MrPolite
umm well ok I'm sure there is nothign wrong with that line of code, but the problem is that the compiler never actually runs the code, it gives me the error before it would fire any events.

just try this, put a textbox and a button on a project. run it, and type a <br> in the textbox. when you press the button and the textbox's contents are submitted you'll get an error

I'm sure there is a simple solution to this, I just dunno how to get around it because I'm new to asp

so I'm talking about 2 problems in this post
1- how to convert those tags to plain text -> you answered me, htmlEncode(), thanks
2- how to aviod that error -> still dunno

Dude apparently you did'nt read my post.

[hellswraith]

As DevGrp said:

ValidateRequest="false"

That is your problem. I had to do it to this page of mine to get it to work:
http://www.variantx.com/Main/DevTools/HTMLEncoder.aspx

[MrPolite]

Originally posted by DevGrp
Dude apparently you did'nt read my post.

lol sorry I wasnt ignoreing you or anything, I swear I didnt even see your post my bad, gotto open my eyes better. thanks for the answer


edit: what other things does that ValidateRequest do?

[DevGrp]

I dont think it does anything else.