Menu
Can anyone please let me know the difference between these two?
AntiXss.HtmlEncode() vs AntiXss.GetSafeHtmlFragment()
410
GetSafeHtmlFragment (AntiXss v4.0) returns HTML fragments with tags intact: Sanitizer.GetSafeHtmlFragment("<b>hello2</b><script>") //Output: <b>hello2</b>
HtmlEncode(String, Boolean) Encodes the specified string for use as text in HTML markup and optionally specifies whether to use HTML 4.0 named entities. HtmlEncode(String, TextWriter) Encodes the specified string for use as text in HTML markup and outputs the string by using the specified text writer.
The Anti-Cross Site Scripting Library (AntiXSS) is an encoding library designed to assist developers in protecting their ASP.NET web-based applications from Cross-Site Scripting (XSS) attacks. It differs from most encoding libraries in that it uses the white-listing technique to provide protection against XSS attacks.
HtmlEcode actually encodes tags:
AntiXss.HtmlEncode("<b>hello</b><script>");
//Output: <b>hello</b><script>
GetSafeHtmlFragment (AntiXss v4.0) returns HTML fragments with tags intact:
Sanitizer.GetSafeHtmlFragment("<b>hello2</b><script>")
//Output: <b>hello2</b>
Many consider the latest version of Microsoft's AntiXSS library broken. I've started using HTML Sanitizer as a decent replacement.
132
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
