title: Getting "A potentially dangerous Request.Path value was detected from the client (&)"
body: <p>I've got a legacy code issue that requires that I support random URLs as if they were requests for the home page. Some of the URLs have characters in them that generate the error <strong>&quot;A potentially dangerous Request.Path value was detected from the client (&amp;)&quot;</strong>. The site is written with ASP.Net MVC 3 (in C#) and is running on IIS 7.5.</p>
  <p>Here's an example URL...</p>
  <pre><code>http://mywebsite.example/Test123/This_&amp;_That
  </code></pre>
  <p>Here's how I have my catch-all route setup (I have other routes to catch specific pages)...</p>
  <pre><code>routes.MapRoute(
      &quot;Default&quot;, // Route name
      &quot;{garb1}/{garb2}&quot;, // URL with parameters
      new { controller = &quot;Website&quot;, action = &quot;Home&quot;, garb1 = UrlParameter.Optional, garb2 = UrlParameter.Optional } // Parameter defaults
  );
  </code></pre>
  <p>I've added the following things to my <code>web.config</code> file...</p>
  <pre><code>&lt;configuration&gt;
      &lt;system.web&gt;
          &lt;pages validateRequest=&quot;false&quot; /&gt;
          &lt;httpRuntime requestValidationMode=&quot;2.0&quot; /&gt;
      &lt;/system.web&gt;
  &lt;configuration&gt;
  </code></pre>
  <p>I've also Added the ValidateInput attribute to the action that should be catching the urls...</p>
  <pre><code>public class WebsiteController : Controller
  {
      [ValidateInput(false)]
      public ActionResult Home()
      {
          return View();
      }
  }
  </code></pre>
  <p>But I'm still getting the error. Any ideas why? Did I miss something? Right now I'm just running on my local dev server (I haven't tried these fixes in production yet).</p>