Question

We have a Website where a user can reject something from another user with a reason. The reason is sent to the other user via email.

What characters can be sent to the other user?
I am not going to do a regex search for unwanted characters but rather only want to keep “potentially” “safe” characters in the reason.

For example the reason:

"Hello <b>Dear User B"

Would be transformed to:

"Hello bDear User B"

Currently i’m just doing a “Where” on the char array and define my “safe” conditions via

char.IsLetterOrDigit || char.IsPunctuation || char.IsWhiteSpace

Are there any better techniques?

Answer 1

You could perfectly fine use HTML in email body. This will allow for prettier formatting. You could use the AntiXSS library on the user input before sending it by email to filter dangerous things out of the HTML (things like <script> tags for example).