I had a code that dynamically creates items and adds them as lookup values. I used CSR but CSR is unavailable on calendar forms (EditForm/NewForm.aspx), so I try to re-write it to vanilla javascript.

I have some form with lookup field pointed to "Customers" ("Customer Name"). And I've added a code that creates new option to this lookup dropdown. Let's pretend I open this NewForm.aspx:

enter image description here

<label for="mylookupid">Lookup ID:</label>
<input type="text" id="mylookupid"/><br/>
<label for="mylookuptext">Lookup text:</label>
<input type="text" id="mylookuptext"/><br/><br/>
<input type="button" id="addoption" title="Add Option" value="Add New Option to 'Customer Name' dropdown" /><br />

<script src="https://code.jquery.com/jquery-3.1.1.min.js"></script>
<script language="javascript" type="text/javascript">

    function addOptionToDropdown() {

        // lookup dropdown 'Customer Name'
        var select = document.querySelector("select[title='Customer Name']");

        // will read actual ID and Title from inputs
        var option = document.createElement('option');
        option.value = jQuery("#mylookupid").val();
        option.innerHTML = jQuery("#mylookuptext").val();   

        // add new option and select it
        option.selected = true;

    function init() {
        jQuery("#addoption").on("click", function () {


Then I go to "Customers" list and create new item, Bob:

enter image description here

Now I have 'Bob' item with ID 138:

enter image description here

Ok, now I want to set this item as new lookup choice (my NewForm.aspx does not know about this new item). I enter ID and Title and press my button:

enter image description here

Bob added. But when I save form I get

"Invalid postback or callback argument. Event validation is enabled using in configuration or <%@ Page EnableEventValidation="true" %> in a page. For security purposes, this feature verifies that arguments to postback or callback events originate from the server control that originally rendered them. If the data is valid and expected, use the ClientScriptManager.RegisterForEventValidation method in order to register the postback or callback data for validation."

enter image description here

Is it possible to avoid it(without CSR because I can't use it on Event forms)?

1 Answer 1


You've run afoul of ASP.NET's Event Validation feature. This is a security feature built into ASP.NET to combat against certain types of web exploits. Basically, it means the server is going to validate the data that gets posted back to it against what it served via server controls, and it they don't match, it's rejected.


If you're running on-premises SharePoint you might be able to set the enableEventValidation to false in the web application's web.config. This may or may not work for you, and it might have unforeseen repercussions.


One thing you might want to try is to simply hijack the save button, cancel the postback in the form and just save the list item directly in JavaScript. In fact that's what I would do.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.