处理“潜在危险的Request.Form值......”

Question

What's the best way to handle errors such as

A potentially dangerous Request.Form value was detected from the client"

in ASP.NET?

I'd like to keep the validation on, as my forms have no valid reasons to be allowing HTML characters. However, I'm not quite sure how to handle this error in a more friendly manner. I tried handling it in a Page_Error but, as far as I can tell, this occurs in a lower level section so the Page_Error function never fires.

Therefore, I may have to resort to using Application_Error in my Global.asax file. If this is the only way of handling that error, is there a way of specifically handling that one error? I don't want to handle all application errors in the same manner.

Thanks

Answer 1

You have two options:

// Editing your global.asax.cs
public class Global : System.Web.HttpApplication
{
    protected void Application_Error(object sender, EventArgs e)
    {
        Exception lastError = Server.GetLastError();
        if (lastError is HttpRequestValidationException)
        {
            Response.Redirect("~/RequestValidationError.aspx");
        }
    }
}

Or

// Editing your CUser.aspx.cs
public partial class CUser : System.Web.UI.Page
{
    protected override void OnError(EventArgs e)
    {
        Response.Redirect("~/RequestValidationError.aspx");
        Context.ClearError();
    }
}

Answer 2

You don't want to go adding unnecessary baggage to the Global.asax. If you're satisfied that this is caused by spurious data input, then deal with the input, no matter where it's coming from:

http://codersbarn.com/post/2008/11/01/ASPNET-Data-Input-Validation.aspx

Concentrate on the cause of the error :-)

Answer 3

您可以在Application_Error中使用Server.GetLastError()来获取抛出的异常，检查异常，并根据需要进行响应（重定向到页面等）