Home/ Questions/Q 520195
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-13T08:07:12+00:00

We have an ASP.NET custom control that lets users enter HTML (similar to a

  • 0

We have an ASP.NET custom control that lets users enter HTML (similar to a Rich text box). We noticed that a user can potentially inject malicious client scripts within the <script> tag in the HTML view. I can validate HTML code on save to ensure that I remove any <script> elements.

Is this all I need to do? Are all other tags other than the <script> tag safe? If you were an attacker, what else would you attempt to do?

Any best practices I need to follow?

EDIT – How is the MS anti Xss library different from the native HtmlEncode for my purpose?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    XSS (Cross Site Scripting) is a big a difficult subject to tackle correctly.

    Instead of black-listing some tags (and missing some of the ways you may be attacked), it is better to decide on a set of tags that are OK for your site and only allowing them.

    This in itself will not be enough, as you will have to catch all possible encodings an attacker might try and there are other things an attacker might try. There are anti-xss libraries that help – here is one from Microsoft.

    For more information and guidance, see this OWASP article.

    • 0