How to use ClientScriptManager.RegisterForEventValidation method

Have you ever encountered this error:

Invalid postback or callback argument.  Event validation is enabled using <pages enableEventValidation=”true”/> in configuration or <%@ Page EnableEventValidation=”true” %> in a page.  For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them.  If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation.

That’s pretty long error message. I get this exception if I add items to drop-down control from JavaScript. The question is how to use ClientScriptManager.RegisterForEventValidation method?

First, let’s reproduce the problem. Create a new website and copy/paste this code:

<asp:DropDownList ID="dd" runat="server">
  <asp:ListItem>One</asp:ListItem>
  <asp:ListItem>Two</asp:ListItem>
</asp:DropDownList>
<asp:Button ID="Button1" runat="server" Text="Test" />

<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"
  type="text/javascript"></script>
<script type="text/javascript">
  $(function()
  {
    $("#<%= dd.ClientID %>").append($("<option />")
      .val(3)
      .text("Three!"));
  });
</script>

If you select option “Three” sure enough, exception is thrown. To prevent it you need to supply all possible values for drop-down control:

protected override void Render(HtmlTextWriter writer)
{
  Page.ClientScript.RegisterForEventValidation(dd.UniqueID, "3");
  Page.ClientScript.RegisterForEventValidation(dd.UniqueID, "4");
  Page.ClientScript.RegisterForEventValidation(dd.UniqueID, "11");
  // and so on
  base.Render(writer);
}

The exception is fixed but server variable for drop-down control is useless – it has no idea that you’ve added new item so dd.SelectedValue will give One, not 3. You need to read POST variable directly instead, like this:

protected void Page_Load(object sender, EventArgs e)
{
   if (IsPostBack)
      Response.Write(Request.Form[dd.UniqueID]);
}

12 thoughts on “How to use ClientScriptManager.RegisterForEventValidation method

  1. Thanks man, really helpful, as I just did the same type of code (including the jQuery option building 🙂 ) and encountered the same problem !

    Keep posting !

  2. If you select option “Three” sure enough, exception is thrown. To prevent it you need to supply all possible values for drop-down control:

    >> meaning you really need to supply all possible value literally? how about for the dynamic values like the possible values would range from 1 to a 100. are we still gonna input that?

  3. Yes, you need to specify every possible value. If you have thousands of entries this becomes rather silly. It’s easier to disable event validation on the page level in these cases.

  4. @Pavel Chuchuva: This is further complicated by having to run the code in the Render() event; so I fill a GridView with rows and custom postbacks, then have to repeat in the render event. However I disagree with Pavel, the event validation is important and should NOT be disabled – it’s not perfect, but it still goes a long way from preventing the page being modified by malicious code.

  5. Great post but I could not get the Request.Form to work. The postback data didn’t contain the new data in my Listbox (html select). I inserted the data to the html select with jquery. I am using the UpdatePanel now to save me head aches. MVC 3 works so much better for this sort of thing. Thanks anyway.

  6. Hi, thanks for the info…..i have a problem though.
    im using an update panel for a drop down list with a selectedindexchange event, when am i suposse to put the “Response.Write(Request.Form[dd.UniqueID]);” if there’s only a postback on my drop down list…i tried to put it inside the selectedindexchange event, and i tried to disable the event validation, but none work….please! help!

Leave a Reply

Your email address will not be published. Required fields are marked *