I've been searching all day and I'm pretty confused about preventing script from being submitted in my MVC application. Most of what I am finding is telling me how to disable request validation, which is not what I want.
In the web.config in the Views folder it states
Enabling request validation in view pages would cause validation to occur after the input has already been processed by the controller. By default MVC performs request validation before a controller processes the input. To change this behaviour apply the ValidateInputAttribute to a controller or action.
That makes it sound like my MVC app should throw the 'potentially dangerous Request.Form value was detected' error when I attempt to submit script tags, but I am still able to submit something like:
</input><script>alert("hello world");</script>
And when I load the page the script has been added to I get a JS alert box.
Why am I able to submit potentially dangerous script? What am I missing?
