c# - Asp.Net MVC routing not accepting & in the route -

i have default asp.net route follows:

routes.maproute(                 name: "default",                 url: "{controller}/{action}/{id}",                 defaults: new { controller = "home", action = "index", id = urlparameter.optional }             ); 

nothing special in it.

and have super simple default action in home controller:

public actionresult index(string id)         {             viewbag.message = "modify template jump-start asp.net mvc application.";              return view();         } 

i can type url: http://localhost:12143/home/index/hanselandcratel

and works fine when type in

http://localhost:12143/home/index/hansel&cratel

it doesn't

i understand & has encoded when type in:

http://localhost:12143/home/index/hansel%26cratel

it still doesn't work error:

a potentially dangerous request.path value detected client (&). 

i aware of setting in web.config:

<httpruntime targetframework="4.5" requestpathinvalidcharacters="" /> 

but afraid have sacrifice security when that.

is there other alternative this? perhaps setting in asp.net?

i aware of setting in web.config: <httpruntime targetframework="4.5" requestpathinvalidcharacters="" />

do not it, you're removing protection given request validation rule. if want allow & character leave others in-place:

<httpruntime requestpathinvalidcharacters="&lt;,&gt;,*,%,:,\,?" /> 

but afraid have sacrifice security when that.

in way & allowed in request urls. careful validate input parameters , to, eventually, escape them required. note should done original rule in-place...

you may re-include other characters i'd suggest if required. may add new ones: have text ids parameters (for ajax requests) , if i'm sure won't ever build sql command concatenating strings...i add ' (and few others).

is there other alternative this? perhaps setting in asp.net?

yes, may go .net 2.0 rules see no reason it...