In HTMLENCODE or not on HTMLENCODE user login in web form (asp.net vb)

Question

I have many options that make up the insert form, for example:

x.Parameters.AddWithValue("@city", City.Text)

This morning I had an unsuccessful xss attack on the site, so I'm still trying to strengthen security measures ....

Should I add my input parameters as follows?

x.Parameters.AddWithValue("@city", HttpUtility.HtmlEncode(City.Text))

Is there anything else I should consider to avoid attacks?

Answer 1

. . - , PDF Word ( - ), , HTML.

, .

, , .

HTML-, , HTML.

... ..

Answer 2

OWASP XSS Prevention Cheat Sheet. html-, , , .

, , htmlEncode() expecct, . OWASP:

HTML- ?

HTML- , HTML, . , , . HTML , , onmouseover CSS, URL-. , HTML , - XSS. escape HTML-, . .

, , XSS. 7 , .