How to display user input safely in HTML?

Question

Suppose I have a textbox on my ASP.net web page where a user enters some text.

On another page, I have the following: <p><%=userText%></p>, where userText refers to the text that the user entered on the previous page.

What do I need to do to make the text display properly if it contains special characters? Also, users can enter text that will be displayed to other users, so it is imperative that I prevent abuse (such as injecting <script> tags.

sanitizing user input is one of the easiest tasks to do, as long as you don't need anything special. As soon as you want to allow the user to add elements to the page, the problem becomes significantly harder. — zzzzBov
– zzzzBov, Commented Jul 15, 2011 at 21:11

Joel Beckham · Accepted Answer · 2011-07-15 20:58:13Z

4

You should HTML encode the data, see here.

String TestString = "This is a <Test String>.";
String EncodedString = Server.HtmlEncode(TestString);

edited Jul 15, 2011 at 20:58

Joel Beckham

18.7k3 gold badges38 silver badges58 bronze badges

answered Jul 15, 2011 at 20:52

Zachary

6,53224 silver badges34 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

How to display user input safely in HTML?

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related