delphi2005 写asp.net网页时，文本框不能输入HTML标记，是不是bug?

[zhbf2000]

就是在页面上加一个Textbox和按钮，在文本框中输入“<font></font>”按钮一点就出错
错误信息如下：
Server Error in '/a' Application.
--------------------------------------------------------------------------------

A potentially dangerous Request.Form value was detected from the client (TextBox1="<font></font>").
Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. You can disable request validation by setting validateRequest=false in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case.

Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (TextBox1="<font></font>").

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:


[HttpRequestValidationException (0x80004005): A potentially dangerous Request.Form value was detected from the client (TextBox1="<font></font>").]
System.Web.HttpRequest.ValidateString(String s, String valueName, String collectionName) +240
System.Web.HttpRequest.ValidateNameValueCollection(NameValueCollection nvc, String collectionName) +99
System.Web.HttpRequest.get_Form() +121
System.Web.UI.Page.GetCollectionBasedOnMethod() +70
System.Web.UI.Page.DeterminePostBackMode() +128
System.Web.UI.Page.ProcessRequestMain() +2112
System.Web.UI.Page.ProcessRequest() +217
System.Web.UI.Page.ProcessRequest(HttpContext context) +18
System.Web.CallHandlerExecutionStep.System.Web.HttpApplication+IExecutionStep.Execute() +179
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +87




--------------------------------------------------------------------------------
Version Information: Microsoft .NET Framework Version:1.1.4322.2032; ASP.NET Version:1.1.4322.2032

[haoco]

up

[pascal_lee_tw]

错误提示：
A potentially dangerous Request.Form value was detected from the client

(txtTest="<b>").

由于在.net中，Request时出现有HTML或Javascript等字符串时，系统会认为是危

险性值。立马报错。

解决方案一：
在.aspx文件头中加入这句：
<%@ Page validateRequest="false" %>

解决方案二：
修改web.config文件:
<configuration>
<system.web>
<pages validateRequest="false" />
</system.web>
</configuration>

因为validateRequest默认值为true。只要设为false即可。