How do we handle HttpRequestValidationException Exception

[Pradeep1210]

Hi,

I have some textboxes on my aspx page. If the user puts "<" or ">" character by mistake in those boxes, it shows the System.Web.HttpRequestValidationException error.

System.Web.HttpRequestValidationException: 
A potentially dangerous Request.Form value was detected from the client 
...

I don't want to turn off ValidateRequests.
So I tried catching it in the Page_Error event, but that event is never fires on this exception.
I also tried overriding the OnError, but without success.

How can I catch this exception and show the user a friendly message?

Pradeep

[mendhak]

You'll need to catch it in your Application_Error event in global.asax because this occurs before page processing.

[Pradeep1210]

You'll need to catch it in your Application_Error event in global.asax because this occurs before page processing.

But this is just for one of the pages. So the application level events don't seem like the appropriate place for that. Also will I be able to continue showing the page after that error?

I have a Panel with a Label in it on the top of my page where I display any errors I encounter. Is it somehow possible possible to show a message in that label?
Something like: "< & > are not allowed in these boxes." etc.

I found many resources on the internet that say that it should be handled in the Page_Error event or the Page OnError method should be overridden. I wonder how it worked for them but not for me?

[mendhak]

Partially true. You can catch it on your page but the page will not continue execution after that.

That is why the recommended practice is to either handle it in global.asax and display a simple message or disable event validation and perform the stripping out/checking for HTML yourself.

[mendhak]

Partially true. You can catch it on your page but the page will not continue execution after that.

That is why the recommended practice is to either handle it in global.asax and display a simple message or disable event validation and perform the stripping out/checking for HTML yourself.

[brin351]

You could use javascript to test for <> and catch the error on the client... Also it's not so bad to handle that error globally and provide a specific error message. Generally if a user enters html tags/script that's not allowed it's not an innocent mistake... generally speaking...