Home/ Questions/Q 880339
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-15T12:04:53+00:00

With .net 4 there’s a new <%: %> script enclosure that’s like <%= %>

  • 0

With .net 4 there’s a new <%: %> script enclosure that’s like <%= %> but does an html encode. People are encouraging the use of this new syntax.

My question is, does <%: %> protect against XSS better or as well as using the Microsoft Anti XSS library?

A Microsoft security person once told me to never just use HTML Encode as it doesn’t protect very well and that I should always use the Anti XSS library (or another library). Is that still true with <%: %>? Or can I confidently use <%: %> knowing it’s going to protect my app from XSS like people are saying?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    HttpUtility.HtmlEncode uses a black list (principle of exclusions) approach to encoding, which potentially leaves the door ajar for newly discover exploits in the future. The Anti-XSS library (now known as the Web Protection Library and includes code to mitigate SQL injection too) uses a whitelist approach (principle of inclusions) which closes the door a little further and should provide better security.

    <%: ... %> is just a shortcut for <%= Server.HtmlEncode(string) %> and therefore provides the security of the encoder used in your application.

    You can use any encoder you like with the new <%: ... %> syntax and Phil Haack has a great post on hooking up the Anti-Xss library as the default encoder. Bear in mind that currently Anti-XSS library 3.1 requires medium trust to run – this is being addressed for a future release.

    • 0