How to Html.Encode in webforms

Question

Hi, I have a webforms applications. There is a page with textboxes and users enters search terms into these which are used to query the database.

I understand I need to prevent javascript injection attacks?

How do I do this?

In MVC I would use Html.Encode. It doesn't seem to be recognising it here.

Thanks!

Answer 1

You can use Server.HtmlEncode (which translates to HttpServerUtility.HtmlEncode) , but there is a better tool.

There is a Web Application Security library that you can download from Microsoft that includes a utility that uses a white-list approach to HtmlEncoding (much safer and better, and recommended by OWASP although they point to an older version). It also has tools that allow you to get safe HTML fragments, etc.

http://blogs.msdn.com/b/securitytools/archive/2010/09/30/antixss_2D00_4_2D00_0_2D00_release_2D00_notes.aspx

You can get it here: http://wpl.codeplex.com/

If you look at nothing else, however, take a look at the OWASP top 10. It sounds like you're just scratching the surface of web app security, and this is the best resource out there. Cross-Site Scripting attacks are just one of a whole slew of things you need to defend against.

It's also the one you will need to conform to if you have to deal with any sort of compliance (PCI, Red flag, etc)

http://www.owasp.org/index.php/Top_10_2010

Answer 2

You can use HttpUtility.HtmlEncode: http://msdn.microsoft.com/en-us/library/system.web.httputility.htmlencode.aspx

Answer 3

On webforms you can call

HttpUtility.HtmlEncode(foo);

Be careful to not double encode.