Question

We have taken over a .NET project recently and upon looking at the db we have the following in some columns:

1) Some columns have values such as
" & etc etc

2) Some have <script> tags and other non html encoded tags

This data is displayed all over the site. When trying out HtmlEncoding on point number 1 we get the following " -> "

Obviously we are wanting to htmlencode when displaying as point 2 contains javascript which we don’t want executed.

Is there a way to use HtmlEncoded on values that might or might not be already encoded?

Answer 1

Is there a way to use HtmlEncoded on values that might or might not be already encoded?

No there isn’t.

What i would suggest is that you write a quick script that goes through the database and unencode the already encoded data. Then use something like the Microsoft AntiXSS library (tutorial here) to encode all output before it gets output to the web page. Remember that it is fine to store the data unencoded¹, the danger is when you echo it back out to the end user.

Some controls already encode output using encode functionality built into the .Net framework – which is not bulletproof to XSS – you just have to either avoid using those controls or just not encode the data displayed by them. There is a FAQ question pertaining to the MS controls that encode at the bottom of the page for the first link which you should read. Also some third party control vendors encode the output of their controls, you would do yourself a favor if you test them to make sure they are not still susceptible to XSS.

¹_{Don’t forget to take steps to prevent SQL injection though!}