By default, the ASP.NET MVC framework prevents you from submitting form data that contains potentially malicious content. This feature is called request validation. For example, submitting the following text in an HTML input field causes the ASP.NET MVC framework to throw an exception (Figure 1): <script>Alert(?I am evil!?);</script> Figure 1 ? An evil form post This is a good feature. You don't want people sneaking scripts into your website that can steal passwords or other sensitive user information. Normally, you want to leave request validation enabled. There are situations, however, when it is perfectly legitimate to want people to submit text that contains HTML markup to a website. For example, you might be hosting a discussion...(read more) ...
Go to the complete details ...