Question

Suppose I have a textbox on my ASP.net web page where a user enters some text.

On another page, I have the following: <p><%=userText%></p>, where userText refers to the text that the user entered on the previous page.

What do I need to do to make the text display properly if it contains special characters? Also, users can enter text that will be displayed to other users, so it is imperative that I prevent abuse (such as injecting <script> tags.

Answer 1

You should HTML encode the data, see here.

String TestString = "This is a <Test String>.";
String EncodedString = Server.HtmlEncode(TestString);