Implement Server.HtmlEncode in gridviews

Question

Say I have a ListView on my aspx page. I need to filter out any possible XSS data that might have snuck inside, but I can't Server.Encode on "eval" whatever that is.

I have code like this, and I don't know how to XSS filter gridviews.

<asp:ListView ID="MyList" runat="server" DataSourceID="MySource" DataKeyNames="ObjectID" OnItemCommand="MyList_OnItemCommand">
        <ItemTemplate>
            <tr id="row" runat="server" class='<%# Container.DataItemIndex % 2 == 0 ? "row" : "altrow" %>'>
                <td align="left">
                    <%# Eval("Name") %>
                </td>

See the problem? Eval("Name") is not XSS filtered. What do I do?

Frédéric Hamidi · Accepted Answer · 2011-08-08 20:05:51Z

1

You can call HttpUtility.HtmlEncode(), which is a static method:

<%# HttpUtility.HtmlEncode(Eval("Name")) %>

answered Aug 8, 2011 at 20:05

Frédéric Hamidi

264k42 gold badges497 silver badges486 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

James Johnson · Accepted Answer · 2011-08-08 20:06:11Z

1

<%# Server.HtmlEncone(Eval("Name")) %>

answered Aug 8, 2011 at 20:06

James Johnson

46.1k8 gold badges75 silver badges111 bronze badges

Collectives™ on Stack Overflow

Implement Server.HtmlEncode in gridviews

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related