An XSS cross-site scripting attack is a cross-site attack of a Web site by a user entering HTML encoding. By using HTML editors such as FCKeditor, Freetextbox, Rich TextBox, Cute Editor, TinyMCE, and so on, users can enter some dangerous characters and inject them into the website in form of XSS. (The general solution is to use the BBCode method, but its expressiveness is not very friendly, and it is not a standard format.) And ANTIXSS is a class library that Microsoft has introduced to prevent XSS, and ANTIXSS works differently from the asp:
- ANTIXSS uses a white list of trusted characters, and the default implementation of ASP. NET is a blacklist of limited untrusted characters, ANTIXSS only allows known safe input, so it provides more security than a filter that tries to block potentially harmful inputs.
- The focus of the ANTIXSS library is to prevent program security vulnerabilities, while ASP. NET encoding focuses on preventing HTML page display from being corrupted.
The role of ASP. ANTIXSS
