Question

I have a client/server application (asp.net), which has a textarea which a user types in html elements+text.

the data being sent from client to server is via jQuery ajax POST. ( to ashx)

lets say the client type in:

<b> Hello </b> 

so I :

1) encodeUriComponent the whole text.

2) Html Encode Special Chars ( like > <)

3) send this to the server

4) save in DB.

Question :

what is the prefered way of saving in db ?

With > <? or should I decode it and then save it?

(data should be presented to user, some time in the future…)

Answer 1

1. POST the raw HTML input to your desired action
2. Use the [AllowHtml] attribute on the desired field of your model.
3. Use Microsoft’s Anti-XSS library to remove any javascript, etc (unless that’s intended).
4. Save raw HTML to your database, but be sure to use parameterized queries to prevent injection attacks.
5. Stop HTML Encoding everything. It looks terrible.