outputting html in runtime in asp.net

Question

Hi all,

I'm building a website at the moment, I've some html fragment that is being stored into the database, I've been reading around that inserting HTML at runtime poses security risks by using the InnerHTML property of any html tag with runat server on it.

So, my question is there any alternative way to safely display the html code and won't pose security risks and is it best to assume any textboxes on any given page is dangerous and process the text in the textboxes with Server.HtmlEncode before I store it to database?

Cheers

Answer 1

You should always HtmlEncode any user generated data before you display it (to avoid XSS attacks).

In asp.net 4.0 they have a new server side output tag to automatically encode data:

<%: "text to encode"%>

This is instead of:

<%= "text that will not be encoded"%>

Which is still around for backwards compatibility.