Question

I am using a CheckBoxList in a VB.NET web project. The elements are pulled from a DataSource which is populated elsewhere in the system.

The problem is, if someone put in some raw HTML, the CheckBoxList seems to render it rather than assume plain text.

In this screenshot, for example, I entered <a href="http://www.google.com" onmouseover="alert('123');">hover here</a> so now whenever you hover over that CheckBox, an alert window pops up. This seems like a potential for XSS and I would like to disable it altogether.

I have tried googling and searching SO for someway to disable HTML rendering such as this, but haven’t found anything relevant, so my apologies if this already has been answered elsewhere.

Thanks!

Answer 1

After binding the datasource, you should be able to iterate through each of the Items in the CheckboxList and use System.Web.HttpServerUtility.HtmlEncode to update each item’s Text property.