I've seen several articles that indicate that if the page directive
validateRequest="True" (shown below) that the user input is validated
against a hard coded list of characters. What I cannot find is any
documentation that shows the hard coded list of characters. Does anyone know
where I can find this list or know exactly what's in the list?

<% @ Page validateRequest="True" %>


Thanks

-- Ken Sturgeon

well - besides having a look with reflector -

it is mostly

< followed by a-z

and

< followed by #

there is a third one i forgot.


-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

[quoted text, click to view]