I have a web user control (.ascx) that holds my product DataList. This product DataList has an ‘add to cart’ button in each item. When I hit one of the ‘add to cart’ button, the ‘Invalid postback or callback argument’ error shows up. Postback from other controls are fine.

<asp:DataList ID=”dlCatalog” runat=”server” SkinId=”catalogList”>
<ItemTemplate>
<div class=”productBox”>
<div class=”productImageContainer”>
<asp:HyperLink ID=”hlImageLink” runat=”server” NavigateUrl=’<%# GetNavigateUrl(Eval(”ProductId”).ToString(), Eval(”Name”).ToString()) %>’ SkinID=”noDefaultImage” />
</div>
<asp:HyperLink ID=”hlProduct” runat=”server” NavigateUrl=’<%# GetNavigateUrl(Eval(”ProductId”).ToString(), Eval(”Name”).ToString()) %>’ Text=’<%# Eval(”Name”) %>’ CssClass=”catalogProductName” />
<br />
<asp:Label ID=”lblRetailPrice” runat=”server” CssClass=”retailPrice” />
<asp:Label ID=”lblOurPrice” runat=”server” CssClass=”ourPrice” />
<br />
<asp:LinkButton ID=”lbAddToCart” runat=”server” OnCommand=”lbAddToCart_Click” CommandArgument=’<%# Eval(”ProductId”).ToString() + “;” + Eval(”Name”).ToString() %>’ CssClass=”button” Text=”Add To Cart” />
</div>
</ItemTemplate>
</asp:DataList>

The following is the complete error message:

Event validation is enabled using <pages enableEventValidation=”true” /> in configuration or <%@ Page EnableEventValidation=”true” %> in a page. For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them. If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation.

The solution is obvious, I should turn off the page directive setting: <%@ Page EnableEventValidation=”false” %>

Since I’m working with a web user control,  I go to its parent page and disable its event validation. And lo, it worked like a charm!

There are however important things to take note. As mentioned in the error message, the event validation makes sure that the postback and callback arguments came from where they are supposed to come from, disabling it causes security risks.

The following links give more information regarding this issue: