When I set <pages validateRequest="true" in web.config , I can't update content in admin mode and in modules. What is the normal solution for that?

If I set validateRequest="false" it is  a security problem, so... 

Hi, thanks for the answer.

Still I'm vulnerable to XSS attacks on some pages when  <pages validateRequest="false" is set to false, based on McAfee tests (I use Server.Encode where appropriate..)

More explanation:

HTTP request validation in ASP.NET is used to make sure that the user entered/selected values of the page controls sent to with the page callbacks are valid values that are not tampered with according to the validation rules set in the code behind and in the ASP.NET itself. For example, when you have a drop-down list control with 3 values, say “Low, Medium, and High”, and the post back sets the value for this control to some other value, say “Critical” that is not in the original list, then the validation check will fail this post back. This was made mainly during the old days when the controls were [always] static. But in today’s dynamic nature of web applications, there are lots of controls that are changed (or even added) dynamically though JavaScript (using jQuery or any other framework). When these control are manipulated this way, the ASP.NET back-end validation will fail most of the times and this will render the application unusable. Hence, we must disable ASP.NET built-in validation (partially) and rely on other methods to offset this. DNN sites use Anti-Forgery Token to prevent XSS for AJAX posts and post-back requests which will keep the site secure from XSS attacks even while setting