Geek Answers Handbook

Why do I need to do html.encode ()

if I have a user entering data into a text editor (tiny editor) and sending the data that I store in the database, and then get to display it on other dynamic web pages, why should I code here.

Is this the only reason someone can paste javascript into the rich text editor? is there any other reason?

+5
source share
9 answers

Security is the reason.

The most obvious / common reason is Cross Site Scripting (XSS). This, it turns out, is the main cause of security problems that may arise on your site.

(XSS) - - script - . , . , -, 80% , Symantec 2007 . 1 , , , .

, , .

Microsoft Anti-Cross Site

http://forums.asp.net/t/1223756.aspx

+16

.

HTML , Html.Encode HTML, .

XSS.

, HTML-:

<b>Hello!</b>
<script>alert('XSS!');</script>

<b>, ( ) <script>.
(, onmouseover) URL- Javascript (, <a href="javascript:alert('XSS!');>Dancing Bunnies!</a>)

HTML XML .

+3

, "" "".

, HTML, HTML. ,

a < b

HTML

a &lt; b

HTML ( , ), :

a < b

HTML- ( , ), HTML, HTML.Encode. , , (, script).

+3

.

+2

javascript - , HTML, . , , : "Nice Page: → ".

, , "" .

+2

, JavaScript, - . , javascript , , XSS:

<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>

XSS; http://ha.ckers.org/xss.html

+1

..... MVC2 , HTML.Encode

to

MVC . / . , MVC2

+1

, </div></table> -. HTML, , html , . . HtmlAgilityPack, .

0

The main reason to do what you offer is to avoid going out. Since you accept HTML and want to output it, you cannot do this. What you need to do is filter out what the user can do, it is unsafe or at least not what you want.

To do this, let me suggest AntiSamy .

You can demo here .

What you do has many inherited risks, and you should be very careful about this.

0
source

More articles:


All Articles