Question

say I have a textBox and a property to get and set its value:

public SomeText
{
   get { return HttpUtility.HtmlEncode(textBox.Text); }
   set { textBox.Text = HttpUtility.HtmlEncode(value); }
}

I have used HtmlEncode to prevent Javascript injection attacks. After thinking about it though I’m thinking I only need the HtmlEncode on the getter. The setter is only used by the system and can not be accessed by an external user.

Is this correct?

Answer 1

Yes. You only need to encode strings that you have accepted from the users and you have to show inside your pages.