Asp.net prevent HTML injection?

Question

In asp.net how do i prevent html injection:

http://example.com?id=asd"%20href="http://google.com"><>

crome disallow but firefox allow to run that script. Is there any way to prevent HTML injection.

Thanks.

Kris · Accepted Answer · 2017-04-10 12:31:30Z

2

There is a Microsoft Tutorial about it: https://msdn.microsoft.com/en-us/library/ff647397.aspx

and this one is about SQL Injection: https://msdn.microsoft.com/en-us/library/ff648339.aspx

^^ still from the ms tuts...

edited Apr 10, 2017 at 12:31

answered Apr 10, 2017 at 12:17

Kris

5127 silver badges16 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Kung Fu Panda Over a year ago

I saw that link. But there is no reference for HTML injection.

Kung Fu Panda Over a year ago

isn't there a way to solve it by using web.config. E.g: validateRequest="true"

Kris Over a year ago

Im not 100% sure but i think i have never seen a automatic option for it... i thinks there its only possible to do it with your own implementation... you could use a filter: learn.microsoft.com/en-us/aspnet/core/mvc/controllers/filters , that way would only to implement it once.

Kung Fu Panda Over a year ago

Thanks, i implemented that code in my global.asax file, if any querystring have invalid HTML paramater, then i will redirect it to 404.aspx.

Collectives™ on Stack Overflow

Asp.net prevent HTML injection?

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related