Home/ Questions/Q 6344621
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-24T20:40:38+00:00

Spoiled by Ruby on Rails (3), I expect all my HTML output to be

  • 0

Spoiled by Ruby on Rails (3), I expect all my HTML output to be automatically encoded.

I asked this question about script exploits a bit earlier and am now wondering, is there some setting, plugin or extension for ASP.NET that will automatically cause all HTML to be HtmlEncode‘ed or do I have to be really careful and ensure that on my own?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Various ASP.NET controls automatically encode HTML with HtmlEncode (and a few do URL encoding with UrlEncode), but it’s not universal. Here’s a list of controls and what encoding (if any) they do automatically. I don’t know if it’s updated for .NET 4.0 or not:

    Which ASP.NET Controls Automatically Encodes? (this link will ask you to save the document)

    This is the blog that the above document is from:

    http://blogs.msdn.com/b/sfaust/archive/2008/09/02/which-asp-net-controls-automatically-encodes.aspx

    It was originally posted in Sep 2008, so it’s probably current for 2.0, but not necessarily 4.0. Still a useful resource to have, though, IMO.

    You should also look at the Microsoft Anti-Cross Site Scripting Library 3.1.

    As pointed out by balexandre, it appears the Anit-XSS library is now part of the open source Web Protection Library:

    Microsoft Web Protection Library

    Also, OWASP is a good resource for security information, and they have an Enterprise Security API project (ESAPI) that is available (to varying degrees) in various programming languages. The .NET one is not complete yet, I believe.

    OWASP Enterprise Security API

    • 0