ASP.NET Cross-site scripting (XSS) prevention with rich-text editor data

Question

User69003606 posted

I am using a rich-text editor on a site to create data that is stored in my database. This means that I have to store encoded html in the database rather than encode on output.

PHP seems to have a number of tools that validate form-input html, and check if the entered data is vulnerable to a cross-scripting attack.

Is there anything like this for asp.net?

 

Cheers,

Peter 

Answer 1

User-186742165 posted

Hi

All User Input Data is dangerous, Therefore, all the aspx page will.ValidateRequest by default, It prevent your site from stop working because of exposing to one of the most common type of attack.  

There is also "Anti-Cross Site Scripting Library" which can be used to protect users from Cross-Site Scripting (XSS) attacks. Hope it helps

Answer 2

User130468220 posted

 1. For Query String:

    Server.HtmlEncode(Request.QueryString["name"].Trim())

2. For Request:

    HttpUtility.HtmlEncode(TxtName.Text.Trim())

3. Use Everytimes While Button Click

    if(Page.IsPostBack)
    {
      // Your Code
    }

4. Use Serverside Validation