Server Error in '/MSSQL' Application

[ulricht]

Hi,
Please, help

I have problem to save an sql stored procedure: GetProductsOnDepartmentPromotion.sql in the hosting MS SQL server 2000 plan(http://domain.com/MSSQL/app/default.aspx),

The result always came like this:

A potentially dangerous Request.Form value was detected from the client (InputText="...E Product.OnDepartmentPromotio...").
[font=Arial, Helvetica, Geneva, SunSans-Regular, sans-serif]Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. You can disable request validation by setting validateRequest=false in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case.

Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (InputText="...E Product.OnDepartmentPromotio...").

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.
Stack Trace:

[HttpRequestValidationException (0x80004005): A potentially dangerous Request.Form value was detected from the client (InputText="...E Product.OnDepartmentPromotio...").] System.Web.HttpRequest.ValidateString(String s, String valueName, String collectionName) +240 System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, String collectionName) +99 System.Web.HttpRequest.get_Form() +113 System.Web.UI.Page.GetCollectionBasedOnMethod() +69 System.Web.UI.Page.DeterminePostBackMode() +128 System.Web.UI.Page.ProcessRequestMain() +2112 System.Web.UI.Page.ProcessRequest() +218 System.Web.UI.Page.ProcessRequest(HttpContext context) +18 System.Web.CallHandlerExecutionStep.System.Web.HttpApplication+IExecutionStep.Execute() +179 System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +87


[/font]Any Solution will be greatfull.
Thanks

 

[Blokz]

You probably have a '>' character in your InputText.

This is seen as potentially dangerous by default.

You can turn it off by putting something like this in your web.config:

<%@ Page validateRequest="false" %>

If you do though, make sure you handle all the validating of inputs yourself.

See here for a better explanation:
http://www.asp.net/faq/RequestValidation.aspx

Blokz

 

[ulricht]

Hi,

I have indroduced this code(blue) in my web.config file, but still the same error.

<configuration>

<system.web>
<pages validateRequest="false" />
</system.web>

<appSettings>
<add key="ConnectionString" value="Data Source=mssql.secured.com; User ID=login; Password=pass; Initial Catalog=database;" />
</appSettings>

<system.web>
<customErrors mode="Off"/>
</system.web>

</configuration>

Here is my sql storedprocedure file that I do not manage to save in my MS SQL database:
(it's the code in red that generate the error message)

CREATE PROCEDURE GetProductsOnDepartmentPromotion
(@DepartmentID int)
AS

SELECT DISTINCT Product.ProductID,Product.[Name], Product.[Description],
Product.Price, Product.ImagePath
FROM Product
INNER JOIN ProductCategory
ON Product.ProductID = ProductCategory.ProductID
INNER JOIN Category
ON ProductCategory.CategoryID = Category.CategoryID
WHERE Product.OnDepartmentPromotion = 1
AND Category.DepartmentID=@DepartmentID

RETURN

Any suggestions?
Thanks

 

[netnewbie]

Need help

I ran into same problem, Could any body help me,please?

thanks