How to prevent entry of HTML into ASP.NET Web form text box

Question

I have several text boxes in an ASP.NET Web Form. I want to ensure that users are not entering HTML into those text boxes. However, I'm not sure how to prevent HTML from being entered. Because of this, I decided that I want to only allow alphanumeric characters, spaces, exclamation point, sharp sign, dollar signs, percentage signs, carets, stars, and left and right parenthesis. I'm omitting the ampersand because I do not want them entering something like "<script&rt;..."

How do I do this? Am I doing it the right way?

Thank you!

Whatever method you choose, make sure that you validate your input both on the client and the server - client validation can be easily bypassed with a javascript debugger. — Erik Forbes
– Erik Forbes, Commented Sep 2, 2010 at 20:23

Ashkan Mobayen Khiabani · Accepted Answer · 2015-07-02 00:40:31Z

1

Have a look here http://msdn.microsoft.com/en-us/library/ff649310.aspx

You can put a blanket statement in the web config ValidateRequest = true will check all user input and throw an error if a user inserts something with bad characters.

If you need to allow some html tags then you will need to roll your own.

edited Jul 2, 2015 at 0:40

Ashkan Mobayen Khiabani

34.3k35 gold badges111 silver badges187 bronze badges

answered Sep 2, 2010 at 20:26

Jonathan S.

5241 gold badge3 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Caspar Kleijne Over a year ago

-1: I don't believe throwing errors/exceptions to users is a good practice. And ValidateRequest = true does not cover all forms of XSS prevention, if that is the intention.

Jonathan S. Over a year ago

@Caspar Kleijne can you provide some references to ValidateRequest not covering all forms of XSS? I'm curious to read about it. I figured that microsoft would do a better job at catching all cases of dangerous user input better than i/ or the average developer could rolling their own.

Caspar Kleijne Over a year ago

ValidateRequest covers only forms of XSS-preventing that are known at the release of a certain version of (ASP).NET. .Net is not updated regularly on production servers. So if the server runs ASP.NET 2.0 or 3.5 (very common) most modern forms of XSS are unknown thus ignored. So it is a line of defense, but a weak one.

CyberDude · Accepted Answer · 2010-09-02 20:27:17Z

1

The page will, by default, prevent users from posting HTML or script in textboxes or textareas. See MSDN

answered Sep 2, 2010 at 20:27

CyberDude

9,2195 gold badges33 silver badges51 bronze badges

Comments

Gabe · Accepted Answer · 2010-09-02 21:58:05Z

1

I've used:

HttpUtility.HtmlEncode();

More info here.

answered Sep 2, 2010 at 21:58

Gabe

50.6k29 gold badges147 silver badges182 bronze badges

Comments

Kaner TUNCEL · Accepted Answer · 2010-09-02 21:55:16Z

0

You can use a method to clean HTML codes from entry like:

public static string ClearHTML(string Str, Nullable<int> Character)
{
    string MetinTxtRegex = Regex.Replace(Str, "<(.|\n)+?>", " ");

    string MetinTxtSubStr = string.Empty;

    if (Character.HasValue)
    {
        if (MetinTxtRegex.Length > Character)
        {
            MetinTxtSubStr = MetinTxtRegex.Substring(0, Character.Value);
            MetinTxtSubStr = MetinTxtSubStr.Substring(0, MetinTxtSubStr.LastIndexOf(" ")) + "...";
        }
        else
        {
            MetinTxtSubStr = MetinTxtRegex;
        }
    }
    else
    {
        MetinTxtSubStr = MetinTxtRegex;
    }
    return MetinTxtSubStr;
}

answered Sep 2, 2010 at 21:55

Kaner TUNCEL

2692 gold badges5 silver badges18 bronze badges

Collectives™ on Stack Overflow

How to prevent entry of HTML into ASP.NET Web form text box

4 Answers 4

3 Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

3 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related