examples of idioms Part 56 How to prevent cross site scripting attack

Link for code samples used in the demo
http://csharp-video-tutorials.blogspo...

Link for csharp, asp.net, ado.net, dotnet basics, mvc and sql server video tutorial playlists
http://www.youtube.com/user/kudvenkat...

Make sure to replace [ with LESSTHAN and ] with GREATERTHAN symbol.

In this video, we will discuss preventing XSS while allowing only the HTML that we want to accept. For example, we only want to accept BOLD and UNDERLINE tags.

To achieve this let's filter the user input, and accept only BOLD and UNDERLINE tags. The following code,
1. Disables input validation
2. Encodes all the input that is coming from the user
3. Finally we selectively replace, the encoded html with the HTML elements that we want to allow.
[HttpPost]
// Input validation is disabled,
// so the users can submit HTML
[ValidateInput(false)]
public ActionResult Create(Comment comment)
{ StringBuilder sbComments = new StringBuilder(); // Encode the text that is coming from comments textbox sbComments.Append(HttpUtility.HtmlEncode(comment.Comments)); // Only decode bold and underline tags sbComments.Replace("<b>", "[b]"); sbComments.Replace("</b>", "[/b]"); sbComments.Replace("<u>", "[u]"); sbComments.Replace("</u>", "[/u]"); comment.Comments = sbComments.ToString(); // HTML encode the text that is coming from name textbox string strEncodedName = HttpUtility.HtmlEncode(comment.Name); comment.Name = strEncodedName; if (ModelState.IsValid) { db.Comments.AddObject(comment); db.SaveChanges(); return RedirectToAction("Index"); } return View(comment);
}

Warning: Relying on just filtering the user input, cannot guarantee XSS elimination. XSS can happen in different ways and forms. This is just one example. Please read MSDN documentation on XSS and it's counter measures.

examples of idioms Part 56 How to prevent cross site scripting attack
242 Likes	242 Dislikes
94,590 views views	524K followers
Education	Upload TimePublished on 15 Jul 2013

Related keywords

asp.net core docker,wcf vs web api,ado.net core,sql server management studio,webkinz,webadvisor,craigslist nj,explained_variance_score,wcf one piece,asp.net core 3,ajax players,examples of personification,weber grill parts,webtoon,tutorials by hugo,csharp corner,mvc design pattern,asp.net machine account,servers for minecraft,asp.net core dependency injection,ado.net tutorial,services angular,explained theme song,explained definition,ajax ontario,example resume,tutorial definition,tutorial on excel,avoidance,asp.net mvc tutorial,examples of alliteration,avoided,asp.net cos'è,csharp assembly,explained sum of squares,tutorialspoint python,sql join,services briefcase,asp.net core web api,ajax jquery,wccftech,craigslist ny,asp.net zero,csharp foreach,server memes,sql date format,services online,chase,examples of culture,serverless architecture,server resume,wcf c#,server books,tutorialspoint javascript,mvcc connect,ado.net mysql,services technologies gps,ajax deadpool,server jobs,cvs,website,mvc tutorial,avoiding using harmful materials,costco hours,explained scps,wcf service application,examples of proteins,tutorialspoint spring,serverless,wcf soap,wcf cat,cool math games,wcf test client,services & training hse colombia sas,servicestack,citibank,asp.net core identity,sql union,ajax parking,sql database,asp.net core logging,mvconnect,cunyfirst,asp.net guida,wcf nba,csharp download,wcfi foundation,csharp online,wcf authentication,tutorials near me,http://asp.net,server 2019,chernobyl,ado.net descargar,web of dreams,serverminer,ajax cleaner,ado.net visual studio 2019,tutorial for windows 10,webassign,ado.net vs entity framework,ado.net visual studio 2017,csharp list,sql like,asp.net mvc,asp.net core tutorial,explained thesaurus,sqlite,wcfm,ajax roster,tutorial gateway,explained monogamy,mvc architecture,http://ado.net,asp.net core mvc,ajax soccer,server hosting,examples of parasitism,wcfi,ajax dish soap,capital one,server rack,avoid in tagalog,tutorialspoint html,avoid bullying,csharp interface,craigslist,webroot,tutorialspoint reactjs,ajax request,wcf dragon ball,explained variance,asp.net core 2.2,tutorialspoint python 3,sql developer,webster,services transmission company sas,avoid the protagonist novel,sql group by,asp.net core signalr,services manager,mvc framework,ajax paving,mvc near me,examples of irony,examples of figurative language,tutorialspoint spring boot,mvc map,csharp online compiler,avoid other term,asp.net download,sql between,ado.net c# pdf,services tag dell,wcf 2019 nba,csharp switch,ado.net ventajas y desventajas,csharpstar,wcf tutorial,examples of adjectives,tutorialspoint,ajax meaning,csharp-video-tutorials.blogspot,tutorials dojo,tutorial mission gta online,central park 5,csharp string format,ado.net c#,asp.net core github,explained synonym,server status,ajax fc,server jobs nyc,asp.net core swagger,sql formatter,credit karma,services group,server error in '/' application,services windows,asp.net core 3.0,sql injection,tutorialspoint c#,wcf ria services,calculator,ado.net entity data model,sql insert,tutorialspoint tableau,services google play apk,explained netflix,sqlyog,asp.net core 3 release date,sql server,server job description,explained_variance_ratio_,explained meaning,tutorials by a,servicenow,examples of lipids,webcam,mvc hours,webmd symptom,csharp array,avoidant personality disorder,csharp enum,ajax call,asp.net core 2. guida completa per lo sviluppatore,asp.net core,server pro,server status ffxiv,cheap flights,webcrims,asp.net core hosting,services sas,examples of metaphors,tutorialspoint java,tutorialspoint java compiler,examples of adverbs,webmd,csharp to json,explained syn,college football,avoid synonyms,ado.net dataset,csharp dictionary,avoid discrimination,tutorial meaning,examples of tone,cnn,website builder,tutorial.mc-complex,tutorialspoint sql,asp.net web api,server side rendering,weber grills,sql server 2017,example synonym,tutorialspoint spark,mvc nj,ado.net oracle,explained variance ratio pca,explained variation calculator,asp.net core download,csharp to vb.net,webster bank,webstaurant,examples of resignation letters,tutorial systems,avoidable cost,tutorialsystems,tutorial teacher,avoidant,ajax post,services fms publish announcement,services.msc no abre,ajax jersey,csharp operator,avoid stress,asp.net core razor pages,server duties,asp.net core environment variables,tutorial on variational autoencoders,csharp random,century 21,explained astrology netflix,examples of carbohydrates,services consultores,services consulting,mvcsd,avoiding,services.msc,mvcsc,ado.net pdf,asp.net core configuration,ajax marvel,tutorial synonym,sql update,asp.net tutorial,mvc medical,example of mutualism,ado.net entity data model visual studio 2019,wcfs international curriculum,mvc2,avoid smoking,ado.net entity data model visual studio 2017,explained in spanish,chase online,explained netflix review,wcf api,explained vox,costco,server jobs near me,webex,sql meaning,sql tutorial,avoiding plagiarism,sql commands,avoid the protagonist,ado.net entity framework,ajax tavern,example cover letter,tutorialsteacher,avoid meaning,ajax javascript,avoidant attachment,services desk,avoid dengue,ajax greek,csharp tutorial,mvc pattern,ado.net sql server,ado.net connection,asp.net identity,mvcu,example of commensalism,asp.net core middleware,explained variance score,wcf web service,mvc webadvisor,tutorial music,web store,mvcc,webmail,mvci,mvctc,