How to display user input safely in HTML?

Question

Suppose I have a textbox on my ASP.net web page where a user enters some text.

On another page, I have the following: <p><%=userText%></p>, where userText refers to the text that the user entered on the previous page.

What do I need to do to make the text display properly if it contains special characters? Also, users can enter text that will be displayed to other users, so it is imperative that I prevent abuse (such as injecting <script> tags.

sanitizing user input is one of the easiest tasks to do, as long as you don't need anything special. As soon as you want to allow the user to add elements to the page, the problem becomes significantly harder. — zzzzBov, Jul 15 '11 at 21:11

score 4 · Accepted Answer · edited Jul 15 '11 at 20:58

4

You should HTML encode the data, see here.

String TestString = "This is a <Test String>.";
String EncodedString = Server.HtmlEncode(TestString);

edited Jul 15 '11 at 20:58

Joel Beckham

18,254
3
35
58

answered Jul 15 '11 at 20:52

Zachary

6,522
22
34

How to display user input safely in HTML?

1 Answers1

Linked