HTML encoding issue in asp.net

Question

I have a literal control being used to display HTML coming from DB. I did face some XSS issues and implemented Anti-XSS Security Runtime Engine (SRE) to automatically encode all html markup. e.g.

DB : <p align="center"></p>

Anti-XSS encodes it as :

&#60;p align&#61;&#34;center&#34;&#62;&#160;&#60;&#47;p&#62

However, when I am setting text property of literal content from code behind, I was expecting that the literal control will DECODE the proper html and display the rendered version. Instead, it is showing the ENCODED version.

Thus literal control displays - <p align="center"></p> postrender. I understand it is Anti-xss in action but how can I get the literal control to show the rendered HTML instead of markup?

ASPX - <asp:Literal ID="ltPageContent" runat="server"></asp:Literal>
Code behind on page load - ltPageContent.Text = getPageContent("home")'Gets HTML from DB

Am I missing something simple here?

user900202 · Accepted Answer · 2011-10-08 08:00:31Z

1

Without considering XSS risks, you may forget LiteralControl here and use inline codes instead:

ASPX:

<%= Server.HtmlDecode(YOUR_STRING) %>

answered Oct 8, 2011 at 8:00

user900202

Sign up to request clarification or add additional context in comments.

2 Comments

Pradeep Kalugade Over a year ago

Thanks, but I prefer not to have any code in aspx. Any solution at code-behind?

user900202 Over a year ago

well, you need a server-side html control as your container and set your html string to its InnerHtml property. For example, put a <div id="container" runat="server"></div> in your aspx page, and then the behind codes could be "container.InnerHtml = Server.HtmlDecode(YOUR_STRING); "

Marty · Accepted Answer · 2014-03-25 04:24:08Z

0

You can also use the "Mode" property with a value of "PassThrough":

<asp:Literal ID="ltPageContent" runat="server" Text="Html Here" 
             Mode="PassThrough" />

I do advise to check for XSS before data is passed here though.

answered Mar 25, 2014 at 4:24

Marty

2,9735 gold badges34 silver badges46 bronze badges

Collectives™ on Stack Overflow

HTML encoding issue in asp.net

2 Answers 2

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related