How to transfer a lot of html content from one .aspx page to other .aspx, any way?

Question

sorry for bad language!

I need a little help. I'm trying to make a asp.Net, c# application for online creating surveys. Main purpose is to dynamically add questions one below the other, then save them and make available to solve them. You select one of four question types, insert parameters and than dynamicly genreate HTML code composed of labels, radio buttons, combos, textboxes ... for each one.
Example of method that is used to generate one question on the form.

public string RetOptionalQuestion(string seq_numm, string question, string answersOpt)

{

StringBuilder _output = new StringBuilder();


_output.Append(@"<table><tr"><th>" + seq_numm + "." + question + "</th></tr>");  
_output.Append(@"<tr><td><table>");

string[] words = answersOpt.Split(';');

int m = 0;
foreach (string word in words)
{
   if (word != "") 
     {
      _output.Append(@" <tr><td> <label> " + word + "</label> </td> <td>
           <input  id='optional" + question + Convert.ToString(m) +
                "'type='radio' name='rbOpt" + question + "' </td> ");
     m++;
     }
}
_output.Append("</table></td></tr></table>");
return _output.ToString();
}

Each time you click Add question, the question appears below each other in div, which is in the ContentPlaceHolder at the bottom of the page.

Now, what I want to do is,that when you click a button, it transfers whole html of this div(ful of questions) on the new .aspx page, so questions are available for solving.

I'm trying with jQuery, to take full html of a div, and save it in cookie, with this help http://jquery-howto.blogspot.com/2010/09/jquery-cookies-getsetdelete-plugin.html ,but without success.

Client error -> A potentially dangerous Request.Cookies value was detected from the client

Do you have any advice, hint, example, solution ... where to start... I would be very pleased

Thanks in advance, Martin

Answer 1

This error occurs because you're storing HTML in the cookie. Given that this looks like a potential XSS attack, this warning is given.

Suggest that you shouldn't be carting HTML along from page to page. Instead, your payload from page to page should be state. The 'receiving' page should be able to inspect the state in the cookie, and rebuild that list of questions. Consider putting that table in an ASP.NET user control, and reusing that control on those 2 pages. This way, you won't have to be hauling HTML around.

Answer 2

Instead of using cookies to move the html in between the requests. You can use session variables or some field in DB. Save the whole html to some hiddenField on source page, and on server-side you can set that html to session variable.

In next page load you can read that html from session variable and then clear the variable. But remember if you want to post html to server you have to set ValidateRequest="false" in your page tag of source page.