XSS in DataBinder.Eval

Question

Where in the following C# codebehind is the potential for XSS?

// Get data based on key names
for (int i = 0; i < m_dataKeyNames.Length; i++)
{
   data[i] = (string)DataBinder.Eval(container.DataItem, m_dataKeyNames[i]);
}

Can this be fixed? Thanks.

Answer 1

Depending on where the data came from, it could contain a script someone has added via another form.

When adding the data and getting the data, you need to santise it using the HtmlEncode method.