How to avoid Cross site scripting in ASP.NET

Question

I have an ASP.NET form which has textbox. The user can enter any characters,numbers etc. I should not restrict the user to filter hazardous characters. But I need to prevent cross site scripting.

The user can enter any text like alert('hi') like this.

The data should be saved as its in DB. Also it should be return back and display in label in form as it is.

How can acheive this without cross site scripting

John Bledsoe · Accepted Answer · 2011-05-03 19:12:10Z

1

Well, I think you should consider some restriction on what users are allowed to enter. You don't want null bytes or non-printable characters do you? Even if you accept more than alphanumeric values, you should decide which characters are allowed and exclude the rest using a simple regular expression (with start and end anchors of course).

Then, the way to prevent XSS is to encode the value whenever you display it. There are a whole host of ways to do this, but using the AntiXSS class of the Microsoft Web Protection Library is the best if you ask me. You can encode the output based on whether you're rendering it within HTML elements, attributes, JavaScript, and so on.

answered May 3, 2011 at 19:12

John Bledsoe

17.8k5 gold badges45 silver badges60 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

web dunia Over a year ago

I dont want to go for first option. I am good with second. if encode "<" this is saving as &lt in DB. I want to display as "<" while retriving. how can I?

Petey B Over a year ago

@web dunia, where are you displaying the result? Browsers will display $lt; as < unless it's in a textbox or something.

John Bledsoe Over a year ago

Encoding before you store in the database is a bad idea, as it doesn't take into account where you're going to output the value. You need different encodings based on whether you output a value in an HTML element or HTML attribute, for instance.

Collectives™ on Stack Overflow

How to avoid Cross site scripting in ASP.NET

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related