C# ASP.NET 文本框双重 HTMLEncode 和防止 XSS

Question

我想防止 XSS，所以我使用 HTMLUtility.HtmlEncode 对所有数据进行编码，然后再将其显示在 ASPNET TextBox 中。但是我没有为 & 显示正确的字符，而是看到了 &。

我应该怎么做才能修复它？

谢谢!

Answer 1

取自微软的 How To: Prevent Cross-Site Scripting in ASP.NET

Filter User Input

If you have pages that need to accept a range of HTML elements, for example through some kind of rich text input field, you must disable ASP.NET request validation for the page. If you have several pages that do this, create a filter that allows only the HTML elements that you want to accept. A common practice is to restrict formatting to safe HTML elements such as bold () and italic ().

To safely allow restricted HTML input

Disable ASP.NET request validation by the adding the ValidateRequest="false" attribute to the @ Page directive.
Encode the string input with the HtmlEncode method.
**Use a StringBuilder and call its Replace method to selectively remove the encoding on the HTML elements that you want to permit.**

基于此，最好的做法似乎是搜索和替换 &和 ＆。看起来不是很优雅，但这直接来自 MSDN。