Is it possible to preserve formatting when adding error message text to be redisplayed on the form. I have some error messages that I need to preserve page breaks in. I have tried using '<br />', '<br>', '\n' 7 '<br>' but to no avail. The break symbol
itself is always displayed.
i want my error messages to display like this
Errors:
<br>
Error Message 1 Line 1
<br>
Error Message 1 Line 2
without displaying the <br> as text.
but instead I get the following;
Errors: <br>Error Message 1 Line 1<br>Error Message Line 2
You're likely going to be more interested in the workings of Html.ValidationMessage() and our other helpers rather than the workings of AddModelError(). AFAIK all of the UI helpers encode their output, so HTML like <br /> will always be rendered as <br
/>.
If you want to display the error messages as HTML, you'll have to create a new helper like Html.FormattedValidationMessage() which is based off of Html.ValidationMessage() but doesn't encode the data. Take a look at
the source for Html.ValidationMessage() and you'll find that it's not a very complex method. It should be fairly straightforward to copy that code into a new method that leaves out the line that does the HTML encoding.
Thanks for the question! :)
Marked as answer by Eilon on Jan 30, 2009 12:55 AM
If your error messages every contain any information from end users, you've just opened yourself up to a potential cross-site scripting attack.
And if you are smart about it, and are just using this when it is needed, then where is the problem? No one ever said that this is something you're going to use EVERYWHERE.
Also, I've yet to put the actual content from the user in any validation messages and don't why you would ever need to do that.
Not doing something just because it could lead to cross-site scripting is not a good reason. Everything you do on a website can lead to issues like this. All you need to do is know what you are doing to avoid that issue.
Scout7
Member
76 Points
212 Posts
ModelState.AddModelError Message Format
Jan 29, 2009 01:33 PM|LINK
Is it possible to preserve formatting when adding error message text to be redisplayed on the form. I have some error messages that I need to preserve page breaks in. I have tried using '<br />', '<br>', '\n' 7 '<br>' but to no avail. The break symbol itself is always displayed.
i want my error messages to display like this
Errors:
<br>
Error Message 1 Line 1
<br>
Error Message 1 Line 2
without displaying the <br> as text.
but instead I get the following;
Errors: <br>Error Message 1 Line 1<br>Error Message Line 2
Any ideas?
levib
Star
7702 Points
1099 Posts
Microsoft
Re: ModelState.AddModelError Message Format
Jan 29, 2009 06:18 PM|LINK
You're likely going to be more interested in the workings of Html.ValidationMessage() and our other helpers rather than the workings of AddModelError(). AFAIK all of the UI helpers encode their output, so HTML like <br /> will always be rendered as <br />.
If you want to display the error messages as HTML, you'll have to create a new helper like Html.FormattedValidationMessage() which is based off of Html.ValidationMessage() but doesn't encode the data. Take a look at the source for Html.ValidationMessage() and you'll find that it's not a very complex method. It should be fairly straightforward to copy that code into a new method that leaves out the line that does the HTML encoding.
Thanks for the question! :)
dwilliams459
Member
77 Points
39 Posts
Re: ModelState.AddModelError Message Format
Apr 09, 2010 01:41 PM|LINK
With MVC 2 I was able to accomplish this by writing an HTML helper that returns the decoded string:
public static string DecodeHtmlHelper(this HtmlHelper helper, MvcHtmlString helperToDecode) { if (helperToDecode != null) return HttpUtility.HtmlDecode(helperToDecode.ToString()); return string.Empty; }</div>And the View:
.Net Senior Developer
dwilliams459
Member
77 Points
39 Posts
Re: ModelState.AddModelError Message Format
Apr 09, 2010 01:59 PM|LINK
I can't seem to get the formatting right, trying again:
public static string DecodeHtmlHelper(this HtmlHelper helper, MvcHtmlString helperToDecode) { if (helperToDecode != null) return HttpUtility.HtmlDecode(helperToDecode.ToString()); return string.Empty; }and:
.Net Senior Developer
bradwils
Contributor
5779 Points
691 Posts
Microsoft
Re: ModelState.AddModelError Message Format
Apr 09, 2010 05:38 PM|LINK
This is a very dangerous path you're on.
If your error messages every contain any information from end users, you've just opened yourself up to a potential cross-site scripting attack.
motoyugota
Member
2 Points
3 Posts
Re: ModelState.AddModelError Message Format
Oct 12, 2010 07:02 PM|LINK
And if you are smart about it, and are just using this when it is needed, then where is the problem? No one ever said that this is something you're going to use EVERYWHERE.
Also, I've yet to put the actual content from the user in any validation messages and don't why you would ever need to do that.
Not doing something just because it could lead to cross-site scripting is not a good reason. Everything you do on a website can lead to issues like this. All you need to do is know what you are doing to avoid that issue.