How to prevent entry of HTML into ASP.NET Web form text box

Question

I have several text boxes in an ASP.NET Web Form. I want to ensure that users are not entering HTML into those text boxes. However, I'm not sure how to prevent HTML from being entered. Because of this, I decided that I want to only allow alphanumeric characters, spaces, exclamation point, sharp sign, dollar signs, percentage signs, carets, stars, and left and right parenthesis. I'm omitting the ampersand because I do not want them entering something like "<script&rt;..."

How do I do this? Am I doing it the right way?

Thank you!

Answer 1

Have a look here http://msdn.microsoft.com/en-us/library/ff649310.aspx

You can put a blanket statement in the web config ValidateRequest = true will check all user input and throw an error if a user inserts something with bad characters.

If you need to allow some html tags then you will need to roll your own.