What version of MS Anti-XSS are you using?

Question

I see there is version 1.5 and 3.0 beta, but I can't seem to find a version 2. Is this just wacky MS versioning?

Are you using 3.0? Would you recommend it, or should I stick with 1.5?

Answer 1

In general I would never recommend to use software in a production environment marked not as stable. I'm using the version 1.5 and that works quite good for me.

Some weeks ago, I tested it against the patterns from http://ha.ckers.org/xss.html and all of the XSS attacks were identified.

Answer 2

If you decompile it, you'll see that the core methods are very simple. It may not be marked "stable" but frankly there isn't anything much in there that could be unstable. Go with 3.0 beta, I say.