ValidateRequest=“假”和 .NET 4 问题
由于某种原因，.NET 4 破坏了 ValidateRequest=“false”。
解决方案是 - 只需将
该解决方案的问题在于它破坏了对 .NET 2.0 的支持！
IIS 拒绝接受 web.config 中的未知属性。我也不喜欢这种全有或全无的性质。
我可以为需要它的单个页面设置 requestValidationMode （或以其他方式禁用请求验证）吗？不破坏 web.config 与 2.0 的向后兼容性？
.NET 4 broke ValidateRequest=“false” for some reason.
The solution is -- just put <httpRuntime requestValidationMode="2.0" /> into your web.config file.
The problem with that solution is that it breaks support for .NET 2.0!
IIS refuses to accept unknown attributes in web.config. Also I don't like the all or nothing nature of this.
Can I set requestValidationMode (or in some other way disable request validation) for a single page that needs it? Without breaking backwards compatibility of web.config with 2.0?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
我可以确认将 validateRequest="true" 添加到 web.config 文件的方法有效，而且非常棒！
使用此选项可以使页面级指令再次正常工作，并且无需将行为更改回 ASP.Net2.0 模式。
奇怪的是它有任何效果，因为请求验证通常默认情况下启用，但没关系。
I can confirm that the approach of adding validateRequest="true" to the web.config file works and it is marvellous!
Using this makes the page-level directives work correctly again and it avoids the need to change the behaviour back to the ASP.Net2.0 mode.
Strange that it has any effect, seeing as request validation is normally enabled by default anyway, but no matter.
如果您使用的是 .net4，则将此行添加到 Web 配置中
，根本不需要使用
if you are using .net4 then add this line to web config
and no need to use
<httpRuntime requestValidationMode="2.0" />at all好吧，看起来这是不可能完成的，我可以轻松地转义数据，但我认为这是一个合理的问题——至少要在这里指出这是不可能完成的。
OK, looks like this can't be done and I can just escape the data easily, but I think this was a legitimate question -- at least to make a note here that this can't be done.
我想我找到了更好的方法。我不喜欢在 4.0 中恢复到 2.0 设置的选项。我也不喜欢全有或全无的选择。
我尝试了一些东西，至少在我的脑海里有一个实用的解决方案。
默认情况下，无论“ValidateRequest =“false”的页面指令如何，所有页面都会被验证，
我在名为页面的 system.web 部分的 web.config 中找到了进行此设置的位置。
(http://msdn.microsoft.com/en-us/library/system.web.configuration.pagessection.validaterequest.aspx)
如果将validateRequest 属性添加到pages 元素中，您可以控制整个站点的验证。
但我在测试这个的时候偶然发现了一件快乐的事情。我找不到这方面的文档，但这是我所经历的。
默认情况下，验证在所有地方都打开，但如果我将 validateRequest 设置为“true”，我的各个页面指令将像在 2.0 中一样工作。我不知道为什么，但我很高兴。
所以总而言之...
将 validateRequest 设置为 true。
就像这里一样。
然后任何页面指令都适用于该验证。
I found a better way, I think. I didn't like the option of reverting back to a 2.0 setting while in 4.0. I also don't like the all or none option.
I played around with a few things and I have at least in my mind a practical solution.
By default all pages are validated regardless of the page directive of "ValidateRequest="false"
I found where to make this setting in the web.config in the system.web section called pages.
(http://msdn.microsoft.com/en-us/library/system.web.configuration.pagessection.validaterequest.aspx)
If the validateRequest attribute is added into the pages element you can control the validation for the whole site.
But I stumbled across a happy thing while testing this. I couldn't find docuementation for this, but here is what I've experienced.
By default validation is turned on everywhere, but if I set the validateRequest to "true" my individual page directives work as they did in 2.0. I don't know why, but I'm happy.
So in summary...
Set the validateRequest to true.
Like here.
Then any page directives work for that validation.
我只是将其放入 system.web 节点的 web.config 中。
I just put this in my web.config in the system.web node.