Asp Buttons not adding to text box - html

Question

I have a multiline textbox, txtPostContest and several buttons that can be clicked to add an HTML tag to the text box (it's for people who won't know any HTML themselves).
However, the buttons only add text once, and after one is clicked none of the others will add text either.
HTML
<div>
<label>Post Content:</label>
</div>
<div>
<asp:Button ID="btnBold" runat="server" Text="Bold" Width="90px" />
<asp:Button ID="btnItal" runat="server" Text="Italics" Width="90px" />
<asp:Button ID="btnLink" runat="server" Text="Link" Width="90px" />
<asp:Button ID="btnImage" runat="server" Text="Image" Width="90px" />
</div>
<div>
<asp:TextBox id="txtPostContent" runat="server" Width="600px" Height="400px" TextMode="MultiLine" />
</div>
VB.Net
Partial Class blogmanager
Inherits System.Web.UI.Page
Dim bold As String = " <strong> </strong> "
Dim ital As String = " <em> </em> "
Dim img As String = " <img src="PASTE IMAGE FILE HERE" alt="TYPE ALTERNATE TEXT HERE" height="250" width="300"> "
Dim link As String = "<a href="PASTE HYPERLINK HERE">PASTE LINK TEXT HERE</a>"
Protected Sub btnBold_Click(sender As Object, e As System.EventArgs) Handles btnBold.Click
txtPostContent.Text += bold
End Sub
Protected Sub btnItal_Click(sender As Object, e As System.EventArgs) Handles btnItal.Click
txtPostContent.Text += ital
End Sub
Protected Sub btnLink_Click(sender As Object, e As System.EventArgs) Handles btnLink.Click
txtPostContent.Text += link
txtPostContent.Text = txtPostContent.Text.Replace(""", ControlChars.Quote)
End Sub
Protected Sub btnImage_Click(sender As Object, e As System.EventArgs) Handles btnImage.Click
txtPostContent.Text += img
txtPostContent.Text = txtPostContent.Text.Replace(""", ControlChars.Quote)
End Sub
I can't see the problem in the simple text += string method but obviously it's no good. Is there a more effective way to bung some text into an existing textbox?

Answer 1

If you click any button such as Bold first, it would work and display
.
But any other click would result an error. For instance when you click italics button
A potentially dangerous Request.Form value was detected from the client (txtPostContent=" ").
The culprit is the text you set in the textarea (). It's potentially dangerous text.
You may want to google for the cross site scripting for details.
Once you put HttpUtility.HtmlEncode function call on all text, the error would be gone. For instance
txtPostContent.Text += HttpUtility.HtmlEncode(bold)
You can add tag validateRequest="false" in your <%# page. but this is highly NOT recommended!!!