asp.net - ValidateRequest 设置为 true 时哪些字符或字符组合无效？

Question

我试过查看微软网站并谷歌搜索，但除了 < 和 > 之外似乎没有人有答案。不过，还有更多。我注意到 &# 的 HTML 实体启动器无效。还有别的事吗？有人有完整的 list 吗？

谢谢!

Answer 1

List of characters by framework version

1.1 Framework Validation:

* &#
* <alpha, <!, </
* script
* On handlers like onmouseenter, etc…
* expression(
* Looks for these starting characters (‘<’, ‘&’, ‘o’, ‘O’, ‘s’, ‘S’, ‘e’, ‘E’)

This is obviously a pretty strict list of items that would trigger a validation error. In the 2.0 Framework, Microsoft decided to loosen the restrictions on this quite a bit. Below is the list of validation checks in the 2.0 Framework.

2.0 Framework Validation:

* &#
* <alpha, <!, </, <?
* Looks for these starting characters (‘<’, ‘&’)