Question

If ASP.NET Request Validation is enabled for a site, do you still need to HtmlEncode and HtmlDecode string information to and from simple forms (e.g. ASP Textboxes)?

Answer 1

If ASP.NET Request Validation is enabled for a site, do you still need to HtmlEncode

ASP.NET Request Validation is a hack to try to work around stupid authors’ broken programs. Don’t write broken programs.

Any text string you write into an HTML page must be HTML-encoded; this is a matter of correctness, not just security (which is a subset of correctness). Even if Request Validation could magically remove any possible XSS attack (and that is so nothing like the case), failing to HtmlEncode text output would still leave you open to producing malformed output, mangling your data. Say I was making a forum post talking about some variables a, b and c and wanted to say:

a<b b>c b>a

If that was echoed to the HTML source unencoded, I’d get:

ac b>a

and maybe the rest of the page would be bold too. Whoops!

Request Validation is bogus and shouldn’t be relied upon. Being on by default and “recommended for all production environments” is sad and makes me seriously doubt the sanity of the ASP.NET team.

If you have written your program correctly, you don’t need it and it will just get in your way. (For example, if SO used it, I wouldn’t be able to make this post that mentions the <script> tag.) If you haven’t written your program correctly, Request Validation isn’t going to fix your security holes, it’s just going to make them a bit more obscure.

and HtmlDecode string information

You don’t usually HtmlDecode anything in a web app. You encode to push content out into HTML, but when content comes back in from a submitted form it is as plain text, not HTML-encoded.

to and from simple forms (e.g. ASP Textboxes)?

Textboxes should be fine; setting their .Text does do any necessary encoding, making the exact string you had appear in the textbox. But. Some things that look like they should be HTML-encoding automatically actually don’t. For example:

myTextBox.Text= "a<b b>c"; // Fine!
myLabel.Text= "a<b b>c"; // Broken!

Oh dear. Text does not always mean Text. Sometimes, it actually means HTML. Thank you Microsoft, way to muddy the waters of a topic too many people already find hard to understand.