I have created a Web User Control for use in DotNetNuke. It has a couple text boxes that capture HTML from the user. However, when the user submits the form I get the "A potentially dangerous Request.Form value was detected from the client...." error.

This can be resolved by adding the page directive validateRequest="false" on a given page or it can be handled in Web.Config for a whole application. Neither of these work for me, as they both expose too much of my app to potential scripting attacks.

Does anyone know of a way I can allow the HTML in the text boxes to be passed through without triggering the error?

---

request validation can't be turned off at the control level.
However, I was just thinking that if you can require script support, you could probably hook the form's submit event and htmlencode the value to be sent. then the serverside code could htmldecode it before using it.

maybe asp.net 2.0 could provide the capability to disable request validation per registered postback control. then a single control could inform the server that it is built to validate and handle such data.