ASP.NET 1.1 adds a request validation feature designed to prevent some types of script injection attacks. If request validation is enabled (the default), ASP.NET will check all posted values, cookies, and the query string for potentially dangerous input. One example of potentially dangerous input is if the user enters a JavaScript block into a textbox. This becomes a problem if your code attempts to display the textbox content by writing it to a web page without first encoding it using the HttpServerUtility.HtmlEncode( ) method. In this case, your page will not just display the textbox contents instead, it will execute the script block. With request validation, however, this shouldn't occur, as ASP.NET will throw the HttpRequestValidationException when a page with potentially dangerous content is posted back to the server.
You can disable request validation by setting the validateRequest attribute in the Page directive to false. In this case, your application should explicitly check or HTML encode all user input. Note that request validation and the HttpRequestValidationException class are only found in Version 1.1 of the .NET Framework.
public sealed class HttpRequestValidationException : HttpException { // No public or protected members }
System.Exception(System.Runtime.Serialization.ISerializable) 