If yu have forms which allow HTML input, and you upgrade from ASP.Net 1.0 to 1.1, you will probably find an error you hadn’t encountered before:
"A potentially dangerous Request.Form value was detected from the client..."
This is a newly added security feature of v1.1.
It can be disabled, however, if you are sure of the security of your form. A good representation of this is the form used to add tips on this web site. All tips go through an authorization process – the input is checked out and verified before it goes live.
In situations like these, you can disable it by adding this to the Page Directive:
validateRequest="false"
You can also add it into the Web.Config file, to disable it for your entire application:
<configuration>
<system.web>
<pages validateRequest="false" />
</system.web>
</configuration>
Naturally, this is normally NOT a good idea, unless you have security measures installed that would prevent damaging input.
Also, you can use ‘Server.HtmlEncode(<Data>)’ to Encode the data as it’s inserted into the table and then, Decode it, when you’re displaying the data.
More information can be found here:
http://www.asp.net/faq/RequestValidation.aspx