URL 危险字符串处理

Question

我有个url 
var s='<p></p>'
url:" a.ashx?id=1&postcontext="+s
   进入ashx页面提示：A potentially dangerous Request.QueryString value was detected from the client  不认<p></p>这个啊
    我用encodeURIComponent(s)
和 encodeURI(s) 都不行

Answer 1

encodeURIComponent(s)应该是可以的.贴全代码.

Answer 2

这是默认的，url不允许出现特殊的字符。
你可以设置一定的规则，然后在跳转过去的ashx再转一次，就行了
比如
var s='pbiaoji'
url:" a.ashx?id=1&postcontext="+s
在ashx再把pbiaoji转为<p></p>就行了

Answer 3

js?var s='<p></p>'
url:"a.ashx?id=1&postcontext="+escape(s)

Answer 4

<%@ Page Language="C#" AutoEventWireup="true" CodeBehind="Default.aspx.cs" Inherits="Study._Default"  ValidateRequest="false" %>

Answer 5

全代码   $("#btn_sumbit").click(
        function () {
            var title = $("#lable_title").html();
            var fck = FCKeditorAPI.GetInstance("FCKeditor1");
            var context = fck.GetHTML();
            if (!confirm('确定要提交信息？'))
                return false;
            $.ajax({
                type: "post",
                url: "../DataHandlers/BBS/Bbs_Edit.aspx?method=postedit&id=" + GetQueryStringValue("id") + "&title=" + encodeURIComponent(title) + "&postcontext=" + encodeURIComponent(context) + "&typeid=" + GetQueryStringValue("typeid"),
                success: function (status) {
                    if (status == 0) {
                        hiddenFck();
                        alert('信息已提交  待审核');
                    }
                    else
                        alert('数据错误')
                },
                error: function () { alert('error') }            });
        }
    );
..后台处理 protected void Page_Load(object sender, EventArgs e)
         {
             string method = Request["method"];
             if (method != null)
             {
                 string msg = string.Empty;
                 string typeid = Request["typeid"];                 switch (method)
                 {                     case "postedit":
                         string id = Request["id"];                         string title = Request["title"];
                         string post_context = Request["postcontext"];
                         Bbs_Posting info = new Bbs_Posting();
                         info.Title = title;
                         info.Context = post_context;
                         info.CreatedBy = int.Parse(EFContext.Current.UserIdentity);
                         info.Created = DateTime.Now;
                         if (!id.IsNullOrEmpty())
                             info.PId = int.Parse(id);
                         if (!typeid.IsNullOrEmpty())
                             info.TypeId = int.Parse(typeid);
                         if (IBbs_ManagersService.EditPost(info))
                             Response.WriteAndEnd((byte)AjaxResponseCode.Success);
                         else
                             Response.WriteAndEnd((byte)AjaxResponseCode.DataError);
                         break;
                     default:
                         break;
                 }
             }
         } 
进入后台就报错
   提示危险字符串<%@ Page Language="C#" ValidateRequest="false" AutoEventWireup="true" CodeBehind="Bbs_Edit.aspx.cs" Inherits="EFInsurance.Web.DataHandlers.BBS.Bbs_Edit" %>

Answer 6

问题在于 我根本就不知道哪里会出现类似这种字符
 整体是一个html

Answer 7

传之前用一个特殊字符串把<p></p>替代了 ，取的时候再换过来

Answer 8

不只可能会出现<p></p>这样的字符啊
   <a href=""></a> 等等
  都会报错
    

Answer 9

编辑器
<pages validateRequest="false" enableSessionState="true" enableViewState="true"/>
提交的字符串用server.htmldecode("字符串")编码  
 

Answer 10

<%@ Page Language="C#" ValidateRequest="false" AutoEventWireup="true" CodeBehind="Bbs_Edit.aspx.cs" Inherits="EFInsurance.Web.DataHandlers.BBS.Bbs_Edit" %>
哥们  我这不是已经写了么  

Answer 11

ValidateRequest="false
不能禁止 Request.QueryString的
你可以这样var s="&amp;lt;p&amp;gt;&amp;lt;/p&amp;gt;"
url:" a.ashx?id=1&postcontext="+s