title: Hidden Input Field causes potentially dangerous Request.Form value error
body: <p>In my ASP.NET 1.1 application, I am compressing and replacing the hidden Viewstate variable with an alternate compressed value, stored in a hidden field called __VSTATE. This works well but on a few occasions, submitting a page causes the common "potentially dangerous Request.Form value ..." error.</p>
  
  <p>I examined the __VSTATE value and nothing seems to be potentially dangerous. I was able to reproduce the error with a completely stripped down version of the page and __VSTATE value as shown below. Pressing the submit button causes the error. The page works fine if I change the value to "".</p>
  
  <pre><code>&lt;%@ Page Language="vb" AutoEventWireup="false" Codebehind="Dangerous.aspx.vb" Inherits="Dynalabs.Dangerous" %&gt;
  &lt;!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"&gt;
  &lt;html&gt;
    &lt;body MS_POSITIONING="FlowLayout"&gt;
  
      &lt;form id="Form1" method="post" runat="server"&gt;
        &lt;input type="hidden" id="__VSTATE" runat="server" value="Onw=" /&gt;
        &lt;asp:Button ID="btnSubmit" Runat="server" Text="Submit" /&gt;
      &lt;/form&gt;
  
    &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>Changing the field name to "MyHiddenWT" made no difference. Removing the runat="server" did stop the error but that just means that .NET only examines server side controls. I also tried some additional values and found that of the following:</p>
  
  <pre><code>"Anw=", "Bnw=", "Cnw=", ... "Nnw=", "Onw=", "Pnw=", ... "Znw=", 
  </code></pre>
  
  <p>"Onw=" is the only one that causes the problem. Is the captial O being seen as an octal value somehow?</p>
  
  <p>Can someone explain why this value is triggering the error message? I'm also looking for a solution but, please, do not tell me to remove page validation. That's the same as saying a car with bad brakes can be fixed by not driving the car.</p>
  
  <p>Thank you in advance.</p>