first thing using validaterequest=false is not secure is right. It may cause of script injection but sql injection can be used. Server.HtmlEncode will protect you for script injection. about the loading time you can check your self as: add: enabled="true" mostRecent="true" requestLimit="50" /> In your web.config file and... Then open trace.axd file by write in end of your url like: http://www.codeproject.com/script/Forums/Edit.aspx/trace.axd

Gaurav Kumar Singh Consultant (Asp.net)

It may cause of very heavy viewstate text in your page. Check your page view source if yes then google for "save viewstate in database"

Gaurav Kumar Singh Consultant (Asp.net)