How to: Prevent script intrusion in WEB applications by applying HTML encoding to Strings

Most script exploits occur when a user can insert executable code (or script) into your application. by default, ASP. NET provides request validation. This validation throws an error whenever the form sends a containing HTML.

You can use the following methods to prevent script exploits:

• Performs parameter validation on form variables, query string variables, and Cookie values.The validation should include two types of validation: You can convert the variable to the validation of the desired type (such as converting to integers, datetime, and so on), as well as validation of the desired range or format.For example, you should use the Int32.TryParse method to check that a form that is expected to be an integer sends a variable to verify that the variable is indeed an integer. Also, you should check the resulting integer to verify that the value is within the range of required values.

• When the value is written back to the response, HTML encoding is applied to the string output. This helps ensure that all string input provided by the user is rendered in the browser as static text, rather than as executable script code or an interpreted HTML element.

HTML encoding uses HTML reserved characters to transform HTML elements to display them instead of executing them.

Apply HTML encoding to a string

htmlencode method. " > before displaying the string, call the HtmlEncode method. html element is converted to a string representation of the browser that will be displayed (rather than interpreted as HTML).

The following example illustrates HTML encoding. In the first instance, encode the user's input before displaying it. In the second instance, encode the data in the database before displaying it.

Note:

@ page attribute validaterequest="false". " > only by adding @ page attribute validaterequest= "false" when request validation is disabled in the page This example does not work. We recommend that you do not disable request validation in the production application, so make sure that request validation is re-enabled after viewing this sample.

1 Private void Button1_Click (object  sender, System.EventArgs e)2{3     Label1.Text = Server.HTMLEncode (TextBox1.Text); 4     5         Server.HTMLEncode (dscustomers1.customers[0]. CompanyName); 6 }