blocks|key|939693|text|那么属性上面的[AllowHtml]属性呢？|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|939694|entityMap^0|7|B|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|K|8|@]|D|@]|E|$]]]|G|$]]

What about <code>[AllowHtml]</code> attribute above property?

blocks|key|1154047|text|添加到模型：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1154048|using+System.Web.Mvc;|code-block|syntax|javascript|1154049|和你的财产|1154050|++++++++[AllowHtml]
++++++++[Display(Name+=+"Body")]
++++++++public+String+Body+{+get;+set;+}|1154051|从我的观点来看，这段代码是避免这个错误的最好方法。如果你使用的是HTML编辑器，你就不会有安全问题，因为它已经被限制了。|1154052|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|O|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|P|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|Q|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|R|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|S|8|@]|9|@]|A|$]]|$1|M|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|N|$]]

Add to model:

<pre><code>using System.Web.Mvc;
</code></pre>

And to your property 

<pre><code> [AllowHtml]
 [Display(Name = "Body")]
 public String Body { get; set; }
</code></pre>

This code from my point the best way avoid this error. If you are using HTML editor you will not have security issues because it already restricted.

blocks|key|1154109|text|在特定属性上添加[AllowHtml]是推荐的解决方案，因为有大量的博客和评论建议降低安全级别，这应该是不可接受的。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1154110|通过添加这一点，MVC框架将允许命中控制器并执行控制器中的代码。|1154111|但是，这取决于您的代码、过滤器等，响应是如何生成的，以及是否有任何可能触发另一个类似错误的进一步验证。|1154112|在任何情况下，添加[AllowHtml]属性都是正确的答案，因为它允许在控制器中反序列化html。视图模型中的示例：|1154113|[AllowHtml]
public+string+MessageWithHtml+{get;+set;}|code-block|syntax|javascript|1154114|entityMap^0|8|B|0|0|0|9|B|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@$9|T|A|U|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|V|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|W|8|@]|D|@]|E|$]]|$1|J|3|K|5|6|7|X|8|@$9|Y|A|Z|B|C]]|D|@]|E|$]]|$1|L|3|M|5|N|7|10|8|@]|D|@]|E|$O|P]]|$1|Q|3|-4|5|6|7|11|8|@]|D|@]|E|$]]]|R|$]]

Adding <code>[AllowHtml]</code> on the specific property is the recommended solution as there are plenty of blogs and comments suggesting to decrease the security level, which should be unacceptable.

By adding that, the MVC framework will allow the Controller to be hit and the code in that controller to be executed.

However, it depends on your code, filters, etc. how the response is generated and whether there is any further validation that might trigger another similar error.

In any case, adding <code>[AllowHtml]</code> attribute is the right answer, as it allows html to be deserialized in the controller. Example in your viewmodel:

<pre><code>[AllowHtml]
public string MessageWithHtml {get; set;}
</code></pre>

blocks|key|939954|text|对数据进行URL编码也适用于我|type|unstyled|depth|inlineStyleRanges|entityRanges|data|939955|例如|939956|var+data+=+'Hello‘|939957|在浏览器中，在发布之前调用encodeURIComponent(data)|939958|在服务器调用HttpUtility.UrlDecode(received_data)上解码|939959|这样，您就可以准确地控制允许哪些字段区域包含html|939960|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|P|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|Q|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|R|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|S|8|@]|9|@]|A|$]]|$1|L|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|M|$]]

URL Encoding the data works as well for me

For example

var data = '&lt;b&gt;Hello&lt;/b&gt;'

In Browser call encodeURIComponent(data) before posting

On Server call HttpUtility.UrlDecode(received_data) to decode

That way you can control exactly which fields area allowed to have html

blocks|key|939832|text|我在使用NopCommerce开发电子商务网站的过程中遇到过这个问题，我通过3种不同的方式得到了这个解决方案，就像前面的答案一样。但根据NopCommerce结构，我不是一次找到这三个。我刚刚看到他们只使用[AllowHtml]，除了任何问题之外，它工作得很好。正如之前问到的question|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|939833|就我个人而言，我不喜欢[ValidateInput(false)]，因为我跳过了全面的模型实体检查，这是不安全的。但是如果有人只是写have+a+look+here|939834|[AllowHtml]+
public+string+BlogText+{get;set;}|code-block|syntax|javascript|939835|然后它只跳过单个属性，只允许特定的属性，几乎不检查所有其他实体。因此，它似乎更倾向于我的。|939836|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/25630141/validateinputfalse-vs-allowhtml|1^0|2V|B|3U|8|0|0|B|M|1U|G|1|0|0|0^^$0|@$1|2|3|4|5|6|7|X|8|@$9|Y|A|Z|B|C]]|D|@$9|10|A|11|1|12]]|E|$]]|$1|F|3|G|5|6|7|13|8|@$9|14|A|15|B|C]]|D|@$9|16|A|17|1|18]]|E|$]]|$1|H|3|I|5|J|7|19|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|1A|8|@]|D|@]|E|$]]|$1|O|3|-4|5|6|7|1B|8|@]|D|@]|E|$]]]|P|$Q|$5|R|S|T|E|$U|V]]|W|$5|R|S|T|E|$U|V]]]]

I have faced this problem during development of a E-Commerce site using NopCommerce, I got this solution by 3 different ways as like the previous answers. But according to the NopCommerce structure I didn't found those three at a time. I have just seen that there they are using just <code>[AllowHtml]</code> and it's working fine except any problem. As previously asked <a href="https://stackoverflow.com/questions/25630141/validateinputfalse-vs-allowhtml">question</a>

Personally I don't prefer <code>[ValidateInput(false)]</code> because i's skipping total model entity checking, which is insecure. But if anyone just write <a href="https://stackoverflow.com/questions/25630141/validateinputfalse-vs-allowhtml">have a look here</a>

<pre><code>[AllowHtml] 
public string BlogText {get;set;}
</code></pre>

then it just skip only single property, and just allow only particular property and check hardly all other entities. Therefore it seems preferable towards mine.

blocks|key|1154212|text|在我的例子中，当与OutputCache操作过滤器结合使用时，AllowHtml属性不起作用。This+answer为我解决了这个问题。希望这对某些人有帮助。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1154213|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/a/16839699/1272229^0|1B|B|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

In my case, the AllowHtml attribute was not working when combined with the OutputCache action filter. <a href="https://stackoverflow.com/a/16839699/1272229">This answer</a> solved the problem for me. Hope this helps someone.

blocks|key|1154327|text|例如，您可以在项目中使用[AllowHtml]|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1154328|+[AllowHtml]
+public+string+Description+{+get;+set;+}|code-block|syntax|javascript|1154329|要在类库中使用此代码，请安装此包|1154330|Install-Package+Microsoft.AspNet.Mvc|1154331|使用此using后|1154332|using+System.Web.Mvc;|1154333|entityMap^0|C|B|0|0|0|0|3|5|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@$9|V|A|W|B|C]]|D|@]|E|$]]|$1|F|3|G|5|H|7|X|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|Y|8|@]|D|@]|E|$]]|$1|M|3|N|5|H|7|Z|8|@]|D|@]|E|$I|J]]|$1|O|3|P|5|6|7|10|8|@$9|11|A|12|B|C]]|D|@]|E|$]]|$1|Q|3|R|5|H|7|13|8|@]|D|@]|E|$I|J]]|$1|S|3|-4|5|6|7|14|8|@]|D|@]|E|$]]]|T|$]]

You Can Use <code>[AllowHtml]</code> To Your Project For Example

<pre><code> [AllowHtml]
 public string Description { get; set; }
</code></pre>

For Use This Code To Class Library You Instal This Package

<pre><code>Install-Package Microsoft.AspNet.Mvc
</code></pre>

After Use This <code>using</code>

<pre><code>using System.Web.Mvc;
</code></pre>

blocks|key|1154397|text|不幸的是，这里的答案对我都不起作用。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1154398|我最终使用了Custom+Model+Binding，并使用了第三方消毒器。|1154399|请参阅我的自我回答问题here。|offset|length|1154400|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/59483284/passing-raw-html-from-view-to-controller-xss-safe-no-information-loss^0|0|0|B|4|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Q|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|R|8|@]|9|@$F|S|G|T|1|U]]|A|$]]|$1|H|3|-4|5|6|7|V|8|@]|9|@]|A|$]]]|I|$J|$5|K|L|M|A|$N|O]]]]

None of the answers here worked for me unfortunately.

I ended up using Custom Model Binding and used a third-party Sanitizer.

See my self-answered question <a href="https://stackoverflow.com/questions/59483284/passing-raw-html-from-view-to-controller-xss-safe-no-information-loss">here</a>.

How can I allow a user to input HTML into a particular field using ASP.net MVC.

I have a long form with many fields that get mapped to this complex object in the controller.

I would like to make one field (the description) allow HTML which I will preform my own sanitation on at a later point.

Allow User to input HTML in ASP.NET MVC - ValidateInput or AllowHtml

服务器

如何允许用户使用ASP.net MVC在特定字段中输入超文本标记语言。我有一个很长的表单，其中有许多字段映射到控制器中的这个复杂对象。我想让一个字段(描述)允许HTML，我将在稍后的时候对其执行我自己的卫生措施。

问允许用户在MVC - ValidateInput或AllowHtml中输入ASP.NET
EN

回答 8

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问允许用户在MVC - ValidateInput或AllowHtml中输入ASP.NETEN

回答 8

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问允许用户在MVC - ValidateInput或AllowHtml中输入ASP.NET
EN