如何在asp.net的文本框中提交HTML标签？

First, I want to let everyone know that I am using an aspx engine not a Razor engine.

首先，我想让每个人都知道我使用的是aspx引擎而不是Razor引擎。

I have a table within a form. One of my textbox contains html tags like

我在表格中有一张桌子。我的一个文本框包含html标签

</br>Phone: </br> 814-888-9999 </br> Email: </br> aaa@gmail.com.

When i go to build it it it gives me an error that says

当我去构建它时它会给我一个错误

A potentially dangerous Request.Form value was detected from the client (QuestionAnswer="...ics Phone:<br/>814-888-9999<br...").

从客户端检测到潜在危险的Request.Form值（QuestionAnswer =“...电话：
814-888-9999

I tried the validation request="false" but it did not work.

我尝试了验证请求=“false”但它没有用。

Im sorry i didn't add my html code for you to look at so far. I am pulling some question up where I can edit it, if need be.

对不起，我没有添加我的HTML代码供你查看到目前为止。如果需要的话，我正在向我提出一些可以编辑的问题。

 <%@ Page Title="" Language="C#" MasterPageFile="~/Views/Shared/Site.Master"   Inherits="System.Web.Mvc.ViewPage<dynamic>" %>


<asp:Content ID="Content1" ContentPlaceHolderID="TitleContent" runat="server">
EditFreqQuestionsUser
</asp:Content>

<asp:Content ID="Content2" ContentPlaceHolderID="MainContent" runat="server">
<script type="text/javascript">
$(document).ready(function () {
    $("#freqQuestionsUserUpdateButton").click(function () {
        $("#updateFreqQuestionsUser").submit();
    });
});
</script>
<h2>Edit Freq Questions User </h2>

<%Administrator.AdminProductionServices.FreqQuestionsUser freqQuestionsUser =   ViewBag.freqQuestionsUser != null ? ViewBag.freqQuestionsUser : new   Administrator.AdminProductionServices.FreqQuestionsUser(); %>
<%List<string> UserRoleList = Session["UserRoles"] != null ? (List<string>)Session["UserRoles"] : new List<string>(); %>
<form id="updateFreqQuestionsUser" action="<%=Url.Action("SaveFreqQuestionsUser","Prod")%>" method="post" onsubmit+>
<table> 
    <tr>
        <td colspan="3" class="tableHeader">Freq Questions User Details <input type ="hidden" value="<%=freqQuestionsUser.freqQuestionsUserId%>" name="freqQuestionsUserId"/> </td>
    </tr>
     <tr>
        <td colspan="2" class="label">Question Description:</td>
        <td class="content">
            <input type="text" maxlength="2000" name="QuestionDescription" value="  <%=freqQuestionsUser.questionDescription%>" />
        </td>
    </tr>
     <tr>
        <td colspan="2" class="label">QuestionAnswer:</td>
        <td class="content">
            <input type="text" maxlength="2000" name="QuestionAnswer" value="<%=freqQuestionsUser.questionAnswer%>" />
        </td>
    </tr>
    <tr>
        <td colspan="3" class="tableFooter">
                <br />
                <a id="freqQuestionsUserUpdateButton" href="#" class="regularButton">Save</a>
                <a href="javascript:history.back()" class="regularButton">Cancel</a>
        </td> 
    </tr>
    </table>
      </form>
</asp:Content>

5 个解决方案

#1

before the page is submitted you need to html encode the textbox's value, with window.escape(...)

在页面提交之前，您需要使用window.escape（...）对文本框的值进行html编码

If you need the un-escaped text on the server side then use HttpUtility.UrlDecode(...) method.

如果您需要服务器端的未转义文本，请使用HttpUtility.UrlDecode（...）方法。

very quick sample:

非常快的样本：

<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="WebForm1.aspx.cs" Inherits="SO.WebForm1" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
    <title></title>
    <script>
        function makeSafe() {
            document.getElementById('TextBox1').value = window.escape(document.getElementById('TextBox1').value);
        };

        function makeDangerous() {
            document.getElementById('TextBox1').value = window.unescape(document.getElementById('TextBox1').value);
        }
    </script>
</head>
<body>
    <form id="form1" runat="server" onsubmit="makeSafe();">
    <div>
        <asp:TextBox ID="TextBox1" runat="server" TextMode="MultiLine" Rows="10" ClientIDMode="Static"></asp:TextBox>
    </div>
    <asp:Button ID="Button1" runat="server" Text="Button" />
    </form>


     <script>
         makeDangerous();
    </script>
</body>
</html>

Make these changes to your code:

对代码进行以下更改：

<script type="text/javascript">
    $(document).ready(function () {
        makeDangerous();
        $("#freqQuestionsUserUpdateButton").click(function () {
            makeSafe();
            $("#updateFreqQuestionsUser").submit();
        });
    });

    // Adding an ID attribute to the inputs you want to validate is simplest
    // Better would be to use document.getElementsByTagName and filter the array on NAME
    // or use a JQUERY select....

    function makeSafe() {
        document.getElementById('QuestionAnswer').value = window.escape(document.getElementById('QuestionAnswer').value);
    };

    // In this case adding the HTML back to a textbox should be 'safe'
    // You should be very wary though when you use it as actual HTML
    // You MUST take steps to ensure the HTML is safe.
    function makeDangerous() {
        document.getElementById('QuestionAnswer').value = window.unescape(document.getElementById('QuestionAnswer').value);
    }
</script>

#2

Decorate your controller action with the [ValidateInput] attribute:

使用[ValidateInput]属性装饰控制器操作：

[ValidateInput(false)]
[HttpPost]
public ActionResult Foo(MyViewModel model)
{
    ...
}

#3

Client JavaScript:

客户端JavaScript：

function codificarTags() {
                   document.getElementById('txtDescripcion').value = document.getElementById('txtDescripcion').value.replace(/</g,'&lt;').replace(/>/g,'&gt;');
            };

<form id="form1" runat="server" onsubmit="codificarTags();">

Server:

服务器：

protected void Page_Load(object sender, EventArgs e)
    {
        txtDescripcion.Text = txtDescripcion.Text.Replace(@"&lt;", @"<").Replace(@"&gt;", @">");

#4

Using html in textbox is not a good practice, maybe use linebreaks (Environment.NewLine) or \r\n instead of br ? .NET Reference

在文本框中使用html不是一个好习惯，可能使用换行符（Environment.NewLine）或\ r \ n而不是br？ .NET参考

Example (in C#) :

示例（在C＃中）：

textBox1.Multiline = true;
textBox1.Text = "test" + Environment.NewLine + "test2";

#5

I would suggest using the AjaxControlToolkit's HTML Editor. I'm implementing that now. If you're textbox is multi-line and big enough to accommodate HTML, why not just bump it up to an HTML editor. Your user will be happier too.

我建议使用AjaxControlToolkit的HTML编辑器。我现在正在实施。如果你的文本框是多行的，并且足够大以容纳HTML，那么为什么不把它提升到HTML编辑器。您的用户也会更快乐。

http://www.asp.net/ajaxLibrary/AjaxControlToolkitSampleSite/HTMLEditor/HTMLEditor.aspx

#1