Request validation is a feature in ASP.NET that protects web applications against potentially malicious content in requests, specifically against cross-site scripting attacks (XSS).

Enable the directive validateRequest in your web.config file: <pages validateRequest="true" />

The following example shows the validateRequest flag set to false in a Web.config file for ASP.NET. This will disable validation, and leave the web application vulnerable against common XSS attacks:

If validateRequest is set to true, validation is enabled:

  • MSDN: Request Validation in ASP.NET .