Post HTML tag (codes) as string with ASP.net MVC & JQuery

Question

I'm trying to post a Form through a MVC Model into a Save function in a controller. I'm also using tinymce on the client side which results a HTML code based string such like  Content text blah blah ....

The problem is that I cannot post a string that includes  something  But surprisingly,  something  this string (with spaces after "<") has NO problem. But, I cannot handle this html code and make these spaces before posting every time. There must be a better way.

So, How can I post a string that includes HTML code through $.post method? (If you must know, this project is a Content Management System. So, I have to save the HTML based content text into a SQL table.) I saw by debugging, the post action does not even reach to the Controller and I think this is a only javascript problem, am I right?

Here is the code I am using:
Javascript

function JqueryFromPost(formId) {

  var form = $(formId);
  var action = form.attr("action");
  var serializedForm = form.serializeArray();

  $.post(action, serializedForm, function (data) {
      //Getting the data Result here...
  });
}

CS Code

   [HttpPost]
   public JsonResult SaveArticle(ArticleModel model)
   {
       JsonResult JResult = new JsonResult();

       if (ModelState.IsValid)
           //I do the saving here ending with "JResult.Data = "Success";" (this could also be Failed. So, its just to explain)

       return JResult;
   }

Darin Dimitrov · Accepted Answer · 2011-01-21 15:09:44Z

56

ASP.NET has built-in request validation that automatically helps protect against XSS and HTML injection attacks. If you want to explicitly disable this validation you could decorate the action you are posting to with the [ValidateInput(false)] attribute:

[HttpPost]
[ValidateInput(false)]   
public ActionResult SaveArticle(ArticleModel model)
{
    var JResult = new JsonResult();
    if (ModelState.IsValid)
    {
        ...
    }
    return JResult;
}

Also if you are running this on ASP.NET 4.0 for this attribute to take effect you need to add the following to your web.config:

<httpRuntime requestValidationMode="2.0" />

And if you are using ASP.NET MVC 3.0 you could decorate only the property on your model that requires HTML with the [AllowHtml] attribute:

public class ArticleModel 
{
    [AllowHtml]
    public string SomeProperty { get; set; }

    public string SomeOtherProperty { get; set; }
}

Also in your javascript function you probably want serialize() instead of serializeArray():

function JqueryFromPost(formId) {
    var form = $(formId);
    $.post(form.action, form.serialize(), function (data) {
        //Getting the data Result here...
    });
}

edited Jan 21, 2011 at 15:09

answered Jan 21, 2011 at 14:06

Darin Dimitrov

1.0m275 gold badges3.3k silver badges3k bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Sol Over a year ago

Very helpful. But I got it working in .NET 4.0 without <httpRuntime requestValidationMode="2.0" />

QMaster · Accepted Answer · 2014-08-10 21:10:58Z

5

You shouldn't use ValidateInput(false) as MSN said here: http://msdn.microsoft.com/en-us/magazine/hh708755.aspx Just use [AllowHtml] on your model property you want take html.

[AllowHtml]
public String htmlContainer { get; set; }

Additionally I think that is better if you encode html and then post it to server.

answered Aug 10, 2014 at 21:10

QMaster

3,9424 gold badges48 silver badges59 bronze badges

Comments

Satwik Vemula · Accepted Answer · 2017-06-16 20:44:51Z

Using [ValidateInput(false)] is a very bad practice which leads to many security breaches, [AllowHtml] on a model property is more secured and reliable way of doing this. But there is a much cleaner solution if you can't use a model property.

Simply Encode the text on Client Side(mycase javascript), Decode it on the serve side(Controller function). I used the below for my vb.net project.

var SearchStringValue = some blah...blah data 

Now encoding the above variable.

var encodedSearchStringValue = window.escape(document.getElementById('SearchStringValue').value)

now pass encodeSearchStringValue to controller using ajax.

In the controller just decode the variable to get  some blah...blah data .

Dim SearchStringValue = HttpUtility.UrlDecode(encodeSearchStringValue)

Hope this helps......... :)

Collectives™ on Stack Overflow

Post HTML tag (codes) as string with ASP.net MVC & JQuery

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related