Problem posting HTML content in WebForms

Question

I apologize in advance if this is posted in the wrong location; I cannot find a form for Webforms or ASP.NET in the listings.  (I also apologize if this is a duplicate question; I had trouble submitting it the first time.)
I'm updating an existing WebForms application for a relative who will undoubtedly find lots of little details for me to fix over the next few weeks.  In order to reduce the number of service calls, I'm implementing a "site config" feature that
will enable him to modify some of the site elements himself, such as toggling the display of certain labels or repositioning the hit count.  The configuration isn't being stored in a database, but rather in an XML document in the site root.  Each
time the form is used to update the XML, a backup is saved, and the site can revert to a previous version if the current config becomes hosed.  In short, I'm not particularly concerned about malicious code going into the XML, although I do have some validation
in place to make sure he doesn't screw things up.
I'd like the config to be able to hold some HTML, so that he can apply custom formatting to the elements he configures, and I have of course applied Server.HtmlEncode to those fields.  But I can't get the form to post HTML content.  The article here
(http://msdn.microsoft.com/en-us/library/a2a4yykt(v=vs.100).aspx) advises me to turn off the request validation using the @ Page attribute ValidateRequest="false."  However, this has no effect.  Upon form submission, the code behind is
completely ignored, and the exception  "A potentially dangerous Request.Form value was detected from the client" is logged.
Is there a way to override this behavior?  I'm using Framework version 4.0 (with Visual Studio 2010).

Answer 1

If I remember correctly, you *should* be able to use whatever value you want for "key" in the RegisterOnSubmitStatement.  Have you tried something like this just for a test?
this.ClientScript.RegisterOnSubmitStatement(
this.GetType(),
"I_Can_Put_Whatever_I_Want_Here",
"alert('Microsoft is Awesome!');"
But I *think* you are having a different issue.  It *sounds* like to me that maybe your EncodeAll ECMA/JavaScript function may not be getting registered properly or in a timely manner.  Have you used IE Developer Tools (F12) to poke around
and view the available ECMA/JavaScript Files and definitions?
There are different ways to register ECMA/JavaScript in *.NET.  One primitive way is to simply put something like this in the "head" tag of your MasterPage or ASPX file:
<script type="text/javascript" src="./myJSFile.js">
</script>
Others ways are to use the
ScriptManager or
RegisterClientScriptInclude .  You can see a few easy examples of how to register ECMA/JavaScript in Mr. Akhtar's post here:
https://stackoverflow.com/questions/1666797/how-to-include-javascript-file-in-asp-net-page
One really *strange* behavior that seems to get a lot of people when registering JavaScript manually via the "script" tag as mentioned above is that you often have to use a *full* </script> end tag for scripts to register properly. 
I have *no* idea why some browsers require this, but it is something web developers need to be aware of.  For example my
"<script type='text/javascript' src='./myJSFile.js'></script>"
example above should work if you have the right path but strangely
"<script type='text/javascript' src='./myJSFile.js' />" does *not* necessarily work on all browsers even if you do use the correct path to the desired ECMA/JavaScript File.
Best,
Shawn