Home/ Questions/Q 8209883
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-07T09:53:03+00:00

In a project at work, I’ve recently been assigned to encode the user input

  • 0

In a project at work, I’ve recently been assigned to encode the user input using the AntiXSS library (v. 4.2.1), even though it’s as good as abandoned and doesn’t even have documentation for the latest version. I looked around a bit and found that I could use something like this for the input: 

<input type="text" value='<%= Microsoft.Security.Application.AntiXss.HtmlEncode() %>' />

Unfortunately, the project I’m working on uses the Knockout library, so if I have:

<input type="text" data-bind="value: Something" />

Would something like this be possible?

 <input type="text" data-bind="value: <%= Microsoft.Security.Application.AntiXss.HtmlEncode(Something) %>" />

Edit: forgot to add that the inputs are handled in the .ascx pages, not .aspx

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Knockout runs on client side (Javascript) and AntiXSS library on server side. You can’t mix this two things. You have to encode your properties in codebehind of your ascx pages after they are sent to the server.

    • 0