how to show pictures by radio button list?

Question

I have a project that I want show one record from DB by radio button list.and after selecting one option and click on Next button next record loads.this is my Html code :

<table style ="width :800px">
        <tr>
            <td style="width: 100px">
                <asp:Image ID="Image1" runat="server" ImageUrl="~/images/stdents12.jpeg" /></td>
        </tr>
        <tr>
            <td style="width: 100px">


                <table style="width: 950px" id="TABLE1" onclick="return TABLE1_onclick()">
        <tr>
            <td colspan="8" style="color: white; height: 21px; background-color: #3366ff">
                <asp:Label ID="Label1" runat="server" Font-Bold="True" Text="Test No :" Width="82px"></asp:Label>
                <asp:Label ID="TestNo" runat="server" Text="Label" Width="100px"></asp:Label><asp:Label ID="Label2" runat="server" Font-Bold="True" Text="Test Name :" Width="84px"></asp:Label>
                <asp:Label ID="TestName" runat="server" Text="Name Of the Test" Width="501px"></asp:Label><asp:Label ID="Label3" runat="server" Font-Bold="True" Text="Question :"></asp:Label>
                <asp:Label ID="Question" runat="server" Text="N of T" Width="52px"></asp:Label></td>
        </tr>
        <tr>
            <td style="width: 23px" rowspan="5">
            </td>
            <td style="width: 100px; height: 1px;">
                &nbsp;</td>
            <td style="width: 100px; height: 1px;">  



            </td>
            <td style="width: 100px; height: 1px;">
            </td>
            <td style="width: 100px; height: 1px;">
            </td>
            <td style="width: 100px; height: 1px;">
            </td>
            <td style="width: 100px; height: 1px;">
                </td>
            <td style="width: 100px; height: 1px;">
             <div class="timerCss"> <asp:Label ID="lblTimerCount" runat="server" Height="5px" Width="232px"></asp:Label>&nbsp;</div>
                </td>
        </tr>
        <tr>
            <td colspan="7" align="right">
                <asp:Image ID="Image2"  runat="server" />
                <asp:Label ID="Questionlbl" runat="server" Height="66px" Text="Label" 
                    Width="317px"></asp:Label></td>
        </tr>
        <tr>
            <td colspan="7">
                &nbsp;</td>
        </tr>
        <tr>
            <td colspan="7">


                <asp:RadioButtonList ID="RadioButtonList1" runat="server" 
                    RepeatDirection="Horizontal">
                </asp:RadioButtonList>


                </td>
        </tr>
        <tr>
            <td style="width: 100px; height: 12px;">
                &nbsp;</td>
            <td style="width: 100px; height: 12px;">
            </td>
            <td style="width: 100px; height: 12px;">
            </td>
            <td style="width: 100px; height: 12px;">
                </td>
            <td style="width: 100px; height: 12px;">
                </td>
            <td style="width: 100px; height: 12px;">
                <asp:Button ID="Button2" runat="server"   Text="Skip" Width="55px" /></td>
            <td style="width: 100px; height: 12px;">
                <asp:Button ID="BtnNext" runat="server" onclick="BtnNext_Click" Text="Next" 
                    Width="70px" />
            </td>
        </tr>
    </table>


            </td>
        </tr>
        <tr>
            <td style="background-color: silver;" class="style1">
            </td>
        </tr>
    </table>

and this is my code behind page:

void Page_PreRender(object sender, EventArgs e)
    {

        OnlineExamEntities context = new OnlineExamEntities();
        StringBuilder bldr = new StringBuilder();
        bldr.AppendFormat("var Timer = new myTimer({0},{1},'{2}','timerData');", this.timerStartValue, this.TimerInterval, this.lblTimerCount.ClientID);
        bldr.Append("Timer.go()");
        ClientScript.RegisterStartupScript(this.GetType(), "TimerScript", bldr.ToString(), true);
        ClientScript.RegisterHiddenField("timerData", timerStartValue.ToString());
        /////////////////////////////
        List<int> a = (List<int>)Session["QnumList"];
        List<string> resulttemp = new List<string>();

        int j = a[Convert.ToInt32(Session["Click"].ToString())];

        var q3 = ((from c in context.questions
                   orderby c.QID
                   where c.QID == j
                   select c)).SingleOrDefault();
        resulttemp.Add(q3.trueAns.ToString());
        Session["result"] = resulttemp;

        Questionlbl.Text = q3.Question1.ToString();
        Image2.ImageUrl = q3.ans4.ToString();
        RadioButtonList1.Items.Clear();
        string ans1, ans2, ans3;
        ans1 = q3.ans1.ToString();
        ans2 = q3.ans2.ToString();
        ans3 = q3.ans3.ToString();
        RadioButtonList1.Items.Add(String.Format("<img src='{0}'>", ans1));
        RadioButtonList1.Items.Add(String.Format("<img src='{0}'>", ans2));
        RadioButtonList1.Items.Add(String.Format("<img src='{0}'>", ans3));

    }

and when I choose one option and click Next button to load another record I get this error :

*A potentially dangerous Request.Form value was detected from the client (RadioButtonList1="*

I adjusted Validate Request ="false" but it's not working.

Answer 1

The server is warning you that someone might insert an Html code For example if you want to get FirstName but someone writes inside: "alert('Haha')", then when you will display the data entered you might see an alert box. It is not a good thing to cancel validation. You can use Server.HtmlEncode for that:

RadioButtonList1.Items.Add(Server.HtmlEncode(String.Format("<img src='{0}'>", ans1)));

And after the user selects a value then you can decode that with Server.HtmlDecode.

However, in this case you just need the chosen img, not the whole img tag, so you can set the value differently (second param is the value):

RadioButtonList1.Items.Add(new ListItem(String.Format("<img src='{0}'>", ans1), ans1));

This way the html form will hold only the image path which is not considered a potentially dangerous value.