Users on my site have a page they can write their own html to. I want this to be used for things like ordered lists, styling, and so on, but some people will try to insert script, which I can’t allow.
The mechanism for updating a user’s description is through ajax. From javascript, I send a request to a file ajax.ashx, which calls a function in ajaxMethods.cs. In the function I update the sql server with the user’s new description.
How can I validate the input in the function, before the description is submited to the server? I want to take out anything to do with scripting, but leave the normal html tags like <p>. Are there any tools that will handle all of this?
Why not allow users to use a custom format / language instead (for example Markdown) and then parse this server side to HTML? This way you know that any script / html code you find within the actual request is invalid and can be stripped (or encoded). This also gives you the advantage of only allow a predetermined list of tags. It would basically give you the same functionality as StackOverflow has.